Malware Analysis Report

2025-03-14 22:29

Sample ID 240407-2x1vasha6v
Target 86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4
SHA256 86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4
Tags
persistence upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4

Threat Level: Shows suspicious behavior

The file 86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence upx

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 22:58

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 22:58

Reported

2024-04-07 23:01

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\spying on gals in toilet.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\winxcfg.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Website Hacker.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\invisible IP.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\hardcored blonde mature.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\teen with her legs wide and fingers in her wet cunt.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\sunbathing beauties tanning tender pussy lips.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\sluty cock sucking chick.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\slutty cum babes sharing a dick.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\genuine indian slut posing.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\cute young tart on a lucky dudes cum shooter.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\busty blondie with cool ass.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\jessica shows us her fat fisting.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Harry Potter and the sorcerors stone.divx.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\anastasia nude.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\sexy hot looking horny ebony teens.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\babe enjoys juicy cumshot.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\aimcracker.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\sluts who are in control of their slaves.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\strange asian ass odyssey.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\cock forced in some slut mouth.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\blonde babe handfucking herself.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\gay blades in the army.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\slutty japanese babe giving blowjob.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe

"C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

memory/900-0-0x0000000000400000-0x0000000000468000-memory.dmp

C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe

MD5 b0bb9f3438922865039c9d72faf223f8
SHA1 7a45e09485e495ae54fa95179e13328279a198fc
SHA256 dc4934d99f2f9a9c5e16129b9b5d5f07d5291666574d63143523e99bbba229ba
SHA512 f5b08170aad85103f561dec78dc982fd7291bc62b69494068c516b56d3d5a434419b9b765a60c792889596a1fab252e4ec908116de3ed9ffa49e7184cba9d743

memory/900-34-0x0000000000400000-0x0000000000468000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 22:58

Reported

2024-04-07 23:00

Platform

win7-20240221-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\macromd\pamela anderson nude.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\wife in kitchen preparing hot pussy for hubby's dinner.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\her taking a dildo right in the ass.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\winxcfg.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Pamela Anderson.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\porn account cracker.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Two girls - Blonde and Brunette - Giving head.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\mature show older pussy and happy to do it.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\ebony spreading her pink wet pussy.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\hot teeny sucking cock.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\slut mouth open wide to take dick in.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\an older fat mom spreading wide.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\fine babe spreading sweet ass and luscious cunt.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\nymph enjoys fisting all the way to the elbow.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\wild stud eating and drilling small pussy freek.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\supermodel nina brosh .mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\lusty teen peeing in backyard.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\horny teen waking up with her pink pussy spread.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\teen bisexual mmf threesome.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\Lolita preteen sex.mpeg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\closeups of horny slut serving up sweet hairy bush.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\asian girls stuffed mouth shots.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\sexy little bitch playing with dildo.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\head rooster pimping hot little tender ass chickens.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A
File created C:\Windows\SysWOW64\macromd\shanks who serve up smelly pootang.mpg.pif C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe

"C:\Users\Admin\AppData\Local\Temp\86094c4ad55224365aa8009e6e9229433e93bae4fd66be6df1e250a506a232a4.exe"

Network

N/A

Files

memory/2216-13-0x0000000000400000-0x0000000000468000-memory.dmp

C:\Windows\SysWOW64\macromd\Pamela Anderson.exe

MD5 66e5d1a48f6b925206b1124d233af399
SHA1 34da7315f825a3f02d99915979dd52747e46599c
SHA256 b8d69a66f4a96279ce32409dca89c8b220a9ef9f9b520a86001d7bc5f371a513
SHA512 bf41839dc332ea71eebe7862f157aeca2167ea1813896bf1de77a0ff3fa27fb8558cb1c2ceca1e12a1af0b1c4055aee860ef09b547074bf7a8f3f2e41c5eec9d

memory/2216-34-0x0000000000400000-0x0000000000468000-memory.dmp