21721becfafaa207a00b205265016930a6c49f89fda8f670d3dbb9920aed9a2c

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4815651a017ac48039d825a607e4c630_JC.exe
Size

81KB
MD5

4815651a017ac48039d825a607e4c630
SHA1

6872c624ac688830341e1f319549b9ab2197446d
SHA256

21721becfafaa207a00b205265016930a6c49f89fda8f670d3dbb9920aed9a2c
SHA512

b6d86523d6de4066809d51f10e0166bad147d787dfdc400d75e4b0a3cc1e689c02b0e2b24e9e222482b297578616a4435b83a7f911634aa91f5ed453a509d9d1
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSVU2QOL0uV4g7lrgS:5JjcF8KfCOcjk+guPVjSV6OL0ud

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1828-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/files/0x0007000000023237-6.dat	upx
behavioral2/memory/1828-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	4815651a017ac48039d825a607e4c630_JC.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\MSN Password Hacker and Stealer.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\yahoo hacker.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\gorgious hotties who stimulated over worked rods.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\hairy lezzies torching it up with hot candles.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\Kama Sutra Tetris.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\krystal steal getting her bald clam filled.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\uncle fred spanking his young nieces little ass.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\an older fat mom spreading wide.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\hard 3 way fuck in car shop.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\uptown girl with great ass that should be illegal.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\her taking a dildo right in the ass.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\extremely fine hoine with incredible sweet twat.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\blonde doing dildo outdoors.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\gorgious babe who quit school to model pretty pink.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\hot japanese office sex.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\fistfucking and how ide it goes.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\GTA3 crack.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\babes with great lips that knows how suck cock.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\Flash Golf.exe	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\twin sisters tag teaming neighbors cock.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe
File created	C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif	4815651a017ac48039d825a607e4c630_JC.exe

C:\Users\Admin\AppData\Local\Temp\4815651a017ac48039d825a607e4c630_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4815651a017ac48039d825a607e4c630_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\16 year old on beach.exe

Filesize
92KB

MD5
baf019d129c4616f8b72fe76e69750f4

SHA1
f2f4aae56dce8b4ce4b39463cbbc1731d808f2bf

SHA256
f2a2bf08daba94911d7992fc50ef4c8b391e409e6cbfd4b101efc91be66b990a

SHA512
5a6b3bf1406dbc3d80e7dff0801c1dc436f3a6870ecfc83963547a3081db527a39c9a4739d50d7fc2fb8be4b83529582fef125ca61aab549885a2979d1225623

Download Submit
memory/1828-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1828-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads