8f848fc7afdb5bc047ff69ee7dd562a349dea36d69bef92658ac939046586f64

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
Size

80KB
MD5

6d0ab5f3fd2d33708ce854a898460350
SHA1

d76574c00f71f4507284cffb2547d7a3525cf400
SHA256

8f848fc7afdb5bc047ff69ee7dd562a349dea36d69bef92658ac939046586f64
SHA512

f919ff95f346ace8bf45081c6175f034e377375d19af32969da2f1b7f6bb10fc6462a8561956a3ec9521fcd2464b6feb136192613429083eb6282d9e7928f084
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSpmnadQyJbQEo:5JjcF8KfCOcjk+guPVjSpSyJbQD

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1140-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/files/0x0009000000015c7a-6.dat	upx
behavioral1/memory/1140-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\plump brunette using her finger.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\Kama Sutra Tetris.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\extremely fine hoine with incredible sweet twat.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\huge titty blonde taking in a full 12 inch cock.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\Cable Modem Uncapper.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\gorgious hotties who stimulated over worked rods.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\wife in kitchen preparing hot pussy for hubby's dinner.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\amateur spreading more fine ass than stud can handle.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\AOL.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\babes with oversized hooters spreading.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\hot japanese office sex.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\fine babe spreading extremely hot ass and furball.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\horny housewife looking for some action.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\hot babe showing her pussy and wanting a stiff cock.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\honie displaying raw pink ass.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\Flash Golf.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\sexy brunette showing her bod outside the house.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\bigger chunky girl with huge tits posing in the buff.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\firm ass honie with thick lips made for sucking rods.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\both holes fucked by a massive fucking machin.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\warcraft 3 crack.exe	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
File created	C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif	NEAS.6d0ab5f3fd2d33708ce854a898460350.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.6d0ab5f3fd2d33708ce854a898460350.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6d0ab5f3fd2d33708ce854a898460350.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe

Filesize
70KB

MD5
507fb2380be7843189c7f0fa782f47cb

SHA1
0a78d165abecacd2daef971f0f5a3bc1b083a311

SHA256
b5fb48fcffa378d6f7b335b0e086351a1f3ebe33189f89e48e4156ccb8a23e87

SHA512
1d1818ca9d6c73a71477731151454606a056eeb1ba6546198e8fe866b110ae6e29033a50cf5bb3feb67005c7048edc5178962cc65c3ebb51d1879fb497a3b67b

Download Submit
memory/1140-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1140-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads