126b7d57700a3cd17e54e91e787275813b67770914e3a0ba0a9011615a756a74

Analysis

max time kernel
101s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d4d3510de053d376ba6b09744255f90N.exe
Size

93KB
MD5

4d4d3510de053d376ba6b09744255f90
SHA1

d7f8063b2849fa9ab9c3833a34145686b9c9275c
SHA256

126b7d57700a3cd17e54e91e787275813b67770914e3a0ba0a9011615a756a74
SHA512

8eefce6e19d3461609dc1a30ce93a482eb3651e5dbf034517340489dc7b6eba4f2506c305ac80012733e98767e92ae4875ce47e4b8ea3145437c9f8f641d2d74
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSzW/vWTAAcG+s6BqS154B4iZTzWUw1H:5JjcF8KfCOcjk+guPVjSzW2TKfg+ji5q

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1536-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/files/0x000700000002343f-6.dat	upx
behavioral2/memory/1536-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	4d4d3510de053d376ba6b09744255f90N.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\siemens unlocker.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\msncracker.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\brutal preteen porn xxx.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\shy teen draining the juice from 2 cocks.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\slutty cum babes sharing a dick.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\Warcraft 3 battle.net serial generator.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\babes with great lips that knows how suck cock.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\some hard sucking and fucking babes.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\asian girls stuffed mouth shots.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\ebony spreading her pink wet pussy.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\closeups of horny slut serving up sweet hairy bush.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\two teen lesbians with dildo having fun.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\kitty-cat with horny beaver that needs licking.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\sexy pink pussy girl taking it off.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\hot babe showing her pussy and wanting a stiff cock.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\happy babe who got 12 inches last night.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\chick weeing in her pants.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\hot actress heather graham naked.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\patricia arquette showing her tits.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\Teen Violent Forced Gangbang.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\busty asian babe with a hairy box.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe
File created	C:\Windows\SysWOW64\macromd\celeb's toes being suck by body-guard.mpg.pif	4d4d3510de053d376ba6b09744255f90N.exe

C:\Users\Admin\AppData\Local\Temp\4d4d3510de053d376ba6b09744255f90N.exe
"C:\Users\Admin\AppData\Local\Temp\4d4d3510de053d376ba6b09744255f90N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe

Filesize
78KB

MD5
c2aafabb6475d1688316fb44b9c73797

SHA1
4f276bb6c58dbfcb5ef007b5b4600fda2532b6d1

SHA256
258c3fdab2b66bf69cb040c7d2c6abf9a25004e764f7b66bec190d9b40405dec

SHA512
93e9499539091b4ee44a66dd5a071bc938a1d68392460e7998a80f2df122b1e443698545c1dedff2201790e08e37bfa68492bfdf44385fc93393a0eae013044b

Download Submit
memory/1536-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1536-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads