437538d2469a9519d19044598f2e071ac4d2cf0f8545728e7dfb856c8f91e8c6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
Size

77KB
MD5

37feaee08dcdbbd074c82e56d15a4f20
SHA1

b55df5423feba99ceae27fbf51d7a58dd3c6b506
SHA256

437538d2469a9519d19044598f2e071ac4d2cf0f8545728e7dfb856c8f91e8c6
SHA512

a82a50baa5d3f153f3b0aeb9fbce48818b983178f1e884ae08cf562913e81864479fb1bfcf3b6bc605a86fda3bf35b0529a6740384c0074265febc86c23fbd9b
SSDEEP

1536:Q4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4m30rTPQz2l:Q4X6NSyfnpijeYEoIcq4lHQ6l

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1200-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-6.dat	upx
behavioral2/memory/1200-28-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\OfficeXP Keygen.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\GTA3 crack.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\porn account cracker.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\invisible IP.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\crack.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\yahoo cracker.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\Windows 2000.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\siemens unlocker.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\Universal Game Crack.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\Want to see a massive horse cock in a tight little teen's pussy.mpg.pif	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\divx pro.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
File created	C:\Windows\SysWOW64\macromd\preteen sucking huge cock illegal.mpg.exe	37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\37feaee08dcdbbd074c82e56d15a4f20_NEAS.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe

Filesize
84KB

MD5
99b5d7e4cc58124bf55141ae722cdd65

SHA1
933c93864866d64d92f2591dbc3b3c792907c8c0

SHA256
7a65f9587228f0902d9202bcb22a7bb6ed7766071c53f8802ab5a5bcd71b61e0

SHA512
5914d461f73bc6fc4a9fafcd80ed365801b5ad58cd9bef1af61935a6c708bb4255e901f52de026ac2a42483c6810b362b0d18443ed8102ba8cec02f09a152bbd

Download Submit
memory/1200-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1200-28-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads