d6fbd56d62bdef48764730f7ee55113ebc2a359a8647050cdc38c338e77fac17

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab92a66c3c90bcfdc72691a868c7d3f5.exe
Size

160KB
MD5

ab92a66c3c90bcfdc72691a868c7d3f5
SHA1

9c5dcdcf913ee35d9cda711622ae3fd9f79fe50f
SHA256

d6fbd56d62bdef48764730f7ee55113ebc2a359a8647050cdc38c338e77fac17
SHA512

7b884cee9d350dbc7d5cdad1f01abf225975896a5b190adccc67d9cc58f6e6eec5f341a1dcb20bdb264b7515f017cb7934215c1b1c4788f4d07e426f76d6b1b7
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08MoesH6pkn:aM7jJlRexYTHYZMI6pkn

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	ab92a66c3c90bcfdc72691a868c7d3f5.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\chicks working orgasm from dude's cock as a present.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\dude getting off in lover's mouth at party.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\Kama Sutra Tetris.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\Digimon.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\tenderonie who insist her pussy must always be free.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\cute teen with her hole spread wide open.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\maid's vagina plowed by big cock.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\sunbathing beauties tanning tender pussy lips.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\Lolita preteen sex.mpeg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\Warcraft 3 battle.net serial generator.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\hot babe getting pussy eaten by horny girlfriend.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\babe with peach shape pussy that needs it bitten.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\preteen sucking huge cock illegal.mpg.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\anastasia nude.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\hairy lezzies torching it up with hot candles.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\hot slut with a big dildo.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\uncle fred spanking his young nieces little ass.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\sexy hot teens gettin busy in shower.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\msncracker.exe	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\sweet ass blonde teen with dripping wet pussy.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\black dude gettin it with two white hoes.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\candy stripper getting down on sick mans cock.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\teen spreading in the kitchen.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\couple babes getting off with well hung dude.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif	ab92a66c3c90bcfdc72691a868c7d3f5.exe

C:\Users\Admin\AppData\Local\Temp\ab92a66c3c90bcfdc72691a868c7d3f5.exe
"C:\Users\Admin\AppData\Local\Temp\ab92a66c3c90bcfdc72691a868c7d3f5.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\msncracker.exe

Filesize
94KB

MD5
b37c67afead25205bf7c7704f8767c63

SHA1
d202d76029811f6d0327548999b1729b37450bb4

SHA256
40f498721c251891d78528bc42a5a35d67d1b249d0f9ec0fadbacb89f201b591

SHA512
3e571998ef2cebb5bb67a16e01428d231a8972c720e1da27f656d38dc48401b1de616e0743f6e012340792a02486e291a4f996c6cb78e4b91d7543da3ee93d29

Download Submit
memory/4580-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads