55ec448013b3a80bd06e0621065671e90135679d284a9179fc7c05421e8292ee

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a3ed6fba808a21b9039707576fa44b7.exe
Size

94KB
MD5

7a3ed6fba808a21b9039707576fa44b7
SHA1

7566fe21985336c405de9f0c9ec4bc6edd51e61a
SHA256

55ec448013b3a80bd06e0621065671e90135679d284a9179fc7c05421e8292ee
SHA512

79c09d53eca88767d663d9d291243c1fe9fe115ab6d0447e1ca0fc8fd52240b126081edb74ccf3b62068fd18afea60dfdccb6a12c3d74fbf4e18b8821fa15005
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMScBLf9B2Zc9Mgblffsi2tX:5JjcF8KfCOcjk+guPVjS4rPbygbtfsnX

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2280-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/files/0x0006000000023213-6.dat	upx
behavioral2/memory/2280-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	7a3ed6fba808a21b9039707576fa44b7.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\slutty japanese babe giving blowjob.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\momma's juggs that make you scream for mercy.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\teen with her legs wide and fingers in her wet cunt.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\japanes girl getting it from behind.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\wild ebony slut taking two cocks.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\genuine indian slut posing.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\shanks who serve up smelly pootang.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\busty ebony girl showing shaved pus.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\Pamela Anderson.exe	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\firm ass honie with thick lips made for sucking rods.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\hot actress heather graham naked.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\sister and brother gettin' freaky .mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\hot busty amateur babe stripping and spreading.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\uptown girl with great ass that should be illegal.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\cock forced in some slut mouth.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\fine babe spreading extremely hot ass and furball.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe
File created	C:\Windows\SysWOW64\macromd\sylvia lauren showing her assets.mpg.pif	7a3ed6fba808a21b9039707576fa44b7.exe

C:\Users\Admin\AppData\Local\Temp\7a3ed6fba808a21b9039707576fa44b7.exe
"C:\Users\Admin\AppData\Local\Temp\7a3ed6fba808a21b9039707576fa44b7.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe

Filesize
75KB

MD5
d563d7a644f801a130833e32e241e5e5

SHA1
f9ce0749703c91c166c70284e0b542682af4c63c

SHA256
ccb4a86606de6f730ae270029de40b936b01a8b274a6d2163307ff738e148878

SHA512
299c1fa57d2654b50dace0a75787bef008425a46c9f834100198fc55084ae84d6c9ece854a3aad4b14f9a10da485f372aa54e8310afa258c0ecc713845d026bd

Download Submit
memory/2280-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2280-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads