bfba02180790f3e7300dc179edf42f11c15a29d9b41bc87b414127d60c682530

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
Size

81KB
MD5

39583aadabfb02ae5ca2430bfdb549d0
SHA1

67e27bef561e5a6b1eb33ddc5d393d6f1b69b165
SHA256

bfba02180790f3e7300dc179edf42f11c15a29d9b41bc87b414127d60c682530
SHA512

74f894a9a70e5cff287a66646f85eae7fc1c3c5e3ddca4dbdbbca6335f14659077eed4a308a8013833c3683d5c515af6164a6bb0d535bb9d8d0c896db0a406a0
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSWfyjs6AbGRix:5JjcF8KfCOcjk+guPVjSXs6v4

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000167ef-5.dat	upx
behavioral1/memory/1604-15-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/1604-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\hot teeny sucking cock.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\trailor tramp pissing for you.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\asian slut with puffy exotic lips.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\celeb's toes being suck by body-guard.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\mature show older pussy and happy to do it.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\honie displaying raw pink ass.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\robin throating and fucking.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\hard cock cumming in her mouth.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\fun slut who let dude eat her off in jacuzzi.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\showing some hot girls share cock.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\happy babe who got 12 inches last night.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\Norton antivirus 2002.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\warcraft 3 crack.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\brunette fucking in bedroom with boyfriend.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\cute young tart on a lucky dudes cum shooter.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\sexy beautiful soon to be pornstar.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\young teen slut with a huge cock in her mouth.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\hot tomoli lathering up sexy body for boyfriend's tongue.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
File created	C:\Windows\SysWOW64\macromd\hot mature blonde in stockings.mpg.pif	NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe

Filesize
82KB

MD5
d79ad0633db6df43b495d061343c3b98

SHA1
ecf6693a417bcf8a3414ce5eeb0c930754e148bb

SHA256
4cb9fd37c8a351288d104ee96fcce038a1819baa6c3c90b301b40709aedafd05

SHA512
3b55184b320eccdabff0bf6e3b04fcb2b8908ff8a511c3101c41881fd5823346b5a74044da0e441e1e28f25cad21e4d0c2938953ea2b9acccc1c709806f0efd0

Download Submit
memory/1604-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1604-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads