Malware Analysis Report

2025-03-14 23:52

Sample ID 240603-gfv79seg48
Target fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f
SHA256 fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f
Tags
upx persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f

Threat Level: Shows suspicious behavior

The file fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx persistence

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 05:45

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 05:45

Reported

2024-06-03 05:47

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\sexy brunette showing her bod outside the house.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\sluty cock sucking chick.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\blonde beauty ass fucked.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\hot japanese office sex.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\patricia arquette showing her tits.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\neighbor boy fucking grandma after mowing her grass.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\naturaly tan babe with gorgous body.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\winxcfg.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\horny ass licking lesbians.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\yahoo cracker.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\honies letting dudes flush mouths full of hot cum.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\hot slut with a big dildo.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\horny asian warming her finger in her gash.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\porn account cracker.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\amateur spreading more fine ass than stud can handle.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\sexy pink pussy girl taking it off.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\Windows 2000.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\blonde with titts and cunt sending chills thru cock.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\old lady in bra and corset with dildo.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\MSN Flooder.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\action with three chicks getting it on with a guy.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\cum hungry teen in action.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe

"C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe"

Network

N/A

Files

memory/2936-0-0x0000000000400000-0x0000000000467000-memory.dmp

C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe

MD5 47b7a733afbbee7c6b2c2b9653d99404
SHA1 cf069ba413f5c250e87f732ed683f35043f0d05d
SHA256 acb3e745102b18c80750a684d77ae24faf7f32e96bc2d345889d65b64502226a
SHA512 772bb6dcb11b686255075606bbf7ca3f5ad15ad56ca256eb0debbb8569d881e86d08b4aad90ce5187559c6225bb922418ce065dc231204a61f0641c752947774

memory/2936-34-0x0000000000400000-0x0000000000467000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 05:45

Reported

2024-06-03 05:47

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\dude getting burned out trying to fuck 2 hot babes.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\busty ebony girl showing shaved pus.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\honies letting dudes flush mouths full of hot cum.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\warcraft 3 crack.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\asian studys how to strip.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\gay guy with a screwing machine.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\pamela anderson nude.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\Blonde and Japanese girl bukkake.mpg.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\maid's vagina plowed by big cock.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\this really wild insane groupsex.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\happy babe who got 12 inches last night.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\jessica shows us her fat fisting.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\winxcfg.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\aimcracker.exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\career girls playing with their snatch after work.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\strange asian ass odyssey.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\babes taking turns munching on hot beavers.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\two large black bones in a small white box.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\Nokia Unloker (most models).exe C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\amateur babe showing pink.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A
File created C:\Windows\SysWOW64\macromd\bottle blonde tramp sucking a dick dry.mpg.pif C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe

"C:\Users\Admin\AppData\Local\Temp\fa0058f0f8524970bb77d263fb7ded1c3ade477beacfed8fc2bb3f118f69e53f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3364-0-0x0000000000400000-0x0000000000467000-memory.dmp

C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe

MD5 843ad864f2e885be2e917d8472ba104e
SHA1 6f55d52e185299d9cfafa0fa0114678be86d7225
SHA256 0c482d999a51c5445c727d899221c4bf993cfb00993a5d2d93cd996248619b79
SHA512 af2656ef1c258cd4da27549e475f46b176618abec277b9831c491a21a192993ec175190fd3b1fc3302cc584c5aaf4ef48ddc7e90c331b143ac70a4e05c479912

memory/3364-34-0x0000000000400000-0x0000000000467000-memory.dmp