Malware Analysis Report

2025-03-14 22:45

Sample ID 240406-1sw5wacb5s
Target 697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542
SHA256 697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542
Tags
upx persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542

Threat Level: Shows suspicious behavior

The file 697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx persistence

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 21:55

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 21:55

Reported

2024-04-06 21:57

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\macromd\aol password cracker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\crack.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Windows 2000.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\nude.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\MSN Flooder.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Blonde and Japanese girl bukkake.mpg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\password stealer.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\porn account cracker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Winzip.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Universal Game Crack.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Want to see a massive horse cock in a tight little teen's pussy.mpg.pif C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\play station emulator crack.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\teen tied up and raped.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\AIM Flooder.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\winxcfg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Britney spears nude.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Microsoft Office XP (english) key generator.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe

"C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe"

Network

N/A

Files

memory/2228-0-0x0000000000400000-0x0000000000464000-memory.dmp

C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe

MD5 3377315461c1ad879ac417647ab7e6c8
SHA1 0fb697ec297649276e5a55ae0cc970b550d445a3
SHA256 78d9329d8c2074535e18d841e7b3a2d76dc4a491fda887e399966726f2fe23be
SHA512 a00da0b908a39f0c9440ecb7eeb4b965f842dc15885571967120d1bc11eda40a3ae86781c5c5d03ed194036dd158b6bc86899188041a6143c75b51ac3361c48c

memory/2228-28-0x0000000000400000-0x0000000000464000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 21:55

Reported

2024-04-06 21:57

Platform

win10v2004-20240319-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\siemens unlocker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\aol password cracker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Want to see a massive horse cock in a tight little teen's pussy.mpg.pif C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\DivX pro key generator.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\XXX Porn Passwords.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Kama Sutra Tetris.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\teen tied up and raped.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\play station emulator crack.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\virtua girl - adriana.pif C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\jenna jameson sex scene huge dick blowjob.scr C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Website Hacker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\AIM Flooder.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\cute girl giving head.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\aimcracker.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\winxcfg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Winzip.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\crack.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A
File created C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe

"C:\Users\Admin\AppData\Local\Temp\697ffdb3348c5c761c2b5ae2a6e7ea0ceb02ff68670360a18003de8a6b1ef542.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.2.37.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
IE 94.245.104.56:443 tcp
GB 51.140.242.104:443 tcp
GB 51.11.108.188:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
GB 13.105.221.15:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp

Files

memory/2304-0-0x0000000000400000-0x0000000000464000-memory.dmp

C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe

MD5 3e133a35e1a2a5b049e707ed33be3c3d
SHA1 65499b1c613fbf484a36a53c80cf24684a021a92
SHA256 4af9f5b95a8df92c223cedc57f8b2970f0d0b20e2dcbe20b82d701627055941b
SHA512 17b8783113723ce6bb46fabeaa6baf03b6c8650d3592fab6eb975d65b36251c9a8c5da5fccb6af72226acccf0b375bb8a6891d7485c2b29a7ba50d935ca79c58

memory/2304-28-0x0000000000400000-0x0000000000464000-memory.dmp