0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
Size

90KB
MD5

560e8b42577b7bc224b80d4adb6418f0
SHA1

40367f85a8cc8d0b61b0309c9116f4f6af834562
SHA256

0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da
SHA512

5e7aabb76acaebc7d5d6a2e64e71aa89b99fbb526ec7f0649c8c43ddf30b0dbbe82b962817db3941422d913a3f502ba9dc4c9dbc0ee2460e98c19e918b650e52
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSJEuZH0AREpIbQD0Bl+sUeu9tJ7:5JjcF8KfCOcjk+guPVjSJE60AREpIEDX

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/files/0x0009000000016197-6.dat	upx
behavioral1/memory/1736-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\aunt and nephew doing the nasty.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\hotmailhacker.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\Blonde and Japanese girl bukkake.mpg.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\porn account cracker.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\chicks working orgasm from dude's cock as a present.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\babes with great lips that knows how suck cock.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\two teenie boppers learning to eat pussy.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\2 horny babes doing 1 lucky dude.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\divx pro.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\Preteen Rape Sex Illegal - Jenny - 13 Years old.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\hot girls who like cock but eat lots of pussy.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\pamela anderson nude.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\honie with a ka-boom hot ass and delicious cunt.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
File created	C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe	0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe

C:\Users\Admin\AppData\Local\Temp\0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe
"C:\Users\Admin\AppData\Local\Temp\0551b2db37fa5c1024ec7e6bde61fbe2335fb5aff8ee54978069828e96dc18da.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\16 year old on beach.exe

Filesize
82KB

MD5
84aea241f36d351cfb3fde3b55ee6d92

SHA1
e5a958246b0b41a9343053d2c758516394f4211c

SHA256
f4f12a9e645ae9f7e7b0172542d2d7bb968e0749759f225b55bf7c914be75fa3

SHA512
4a187c40b277ea1a69360376c556f8568e7b232b5fc6abccfaa2d208334cef1aa3ce6c05001fef55e6bcb08803da1b3b4d944614f8ed3a94715c4f176f2d0d00

Download Submit
memory/1736-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1736-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads