97383da14773c9b166287c9daac326ecf9d7e6365537fb27318ba2f9875b7232

Analysis

max time kernel
71s
max time network
35s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
Size

88KB
MD5

0b11164ff569bf53cc636f800a89cad0
SHA1

f9de2da5c9014e35614bf811f8020507ed200d08
SHA256

97383da14773c9b166287c9daac326ecf9d7e6365537fb27318ba2f9875b7232
SHA512

b18503624fad071d9ceca2339c3ae99fc468c9ff644670c96ca9c8243e17c392998c69a5805b0099dacedc2334317dc6bb6796a2d06c42833d8666883c6053a8
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMShfc3HrPNax0rgavQO:5JjcF8KfCOcjk+guPVjS+1/TP

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2284-3-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/files/0x0006000000018b0f-6.dat	upx
behavioral1/memory/2284-16-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2284-35-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\Napster Clone.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\horny little blonde spreading pink.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\big dicked shemale being boned.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\ebony girl with massive hooters.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\nice facial cumshot for slut.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\invisible IP.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\sexy hot teens gettin busy in shower.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\sweet ass blonde teen with dripping wet pussy.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\2 horny babes doing 1 lucky dude.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\this really wild insane groupsex.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\candy stripper getting down on sick mans cock.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\asian girls stuffed mouth shots.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\nasty brunette getting hard jolting.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\AIM Flooder.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\tiny little virgin showing off her cherry pussy.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\sexy brunette showing her bod outside the house.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\sexy beautiful soon to be pornstar.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\babe with peach shape pussy that needs it bitten.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\bottle blonde tramp sucking a dick dry.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\gay stud giving head and fucking.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
File created	C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif	NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0b11164ff569bf53cc636f800a89cad0_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe

Filesize
75KB

MD5
151b0bc82902883108b0300398e5fdf5

SHA1
0ac794912d135fd1b116cb0b7ad7a6220cfc6885

SHA256
f883d470e3ac8757c1f61b21579b6a6c9534d479c0c40e8f454c97346338bfd9

SHA512
ca148a596189dbf26bf1634279935ced8d64e254b4cf05a7d9fb34a5a9a23c0c0e7d6121ea3a2e6ca5a2e1c9258cfec198073159e265505d1530f7aa0f3fff5b

Download Submit
memory/2284-3-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2284-16-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2284-35-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads