0a2074451143caac9612edca7935e4621e646219a46e77fe507eb57f8e63a504

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
Size

423KB
MD5

62bbe8a99c2f0f84d469ebc65de3c7f0
SHA1

6a4fd45795c3e1f264b5007d5bb415b78eba544b
SHA256

0a2074451143caac9612edca7935e4621e646219a46e77fe507eb57f8e63a504
SHA512

d0752bad2d5f4a381986208d0848a4ad9b24a39feef18f3b0225112e94d0a1055bb98dc1c5341301889d88ab99a631727163fa50f141f2d2b9d65d58fe2edac9
SSDEEP

3072:LmVW8iTX/3Rfl8Xq1+0cxxsWEL02fXcIp08Moe9DESZL1U4JkMPrh:SM7jJljxYTHYZM1vq4JkMF

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001469d-5.dat	upx
behavioral1/memory/2088-11-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2088-34-0x0000000000400000-0x0000000000468000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\some hard sucking and fucking babes.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\tenderonie who insist her pussy must always be free.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\candy stripper getting down on sick mans cock.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\teen spreading in the kitchen.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\Cable Modem Uncapper.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\hot mature blonde in stockings.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\Lolita preteen sex.mpeg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\Preteen Rape Sex Illegal - Jenny - 13 Years old.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\cool rooster raiding hen house for hot babes, link city.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\naturaly tan babe with gorgous body.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\bigger chunky girl with huge tits posing in the buff.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\sexy amatures sucking whole bag.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\asian studys how to strip.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\charlize theron naked.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\plump brunette using her finger.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\sexy babe drinking hot jizz load.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\blonde babe handfucking herself.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\aimhacker.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\bottle blonde tramp sucking a dick dry.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\two studs fucking the hell out of a slut from behind.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\busty asian with big lips.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\black girl gets dildo wet.mpg.pif	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	62bbe8a99c2f0f84d469ebc65de3c7f0N.exe

C:\Users\Admin\AppData\Local\Temp\62bbe8a99c2f0f84d469ebc65de3c7f0N.exe
"C:\Users\Admin\AppData\Local\Temp\62bbe8a99c2f0f84d469ebc65de3c7f0N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe

Filesize
96KB

MD5
da7654b648e110fddfd56446bb971a6f

SHA1
dd04d39390e15787b218a7c84f4b96eff39981c6

SHA256
5fdaeaef2b447d00a03741f037db21d80030a96f93b478b29ec2fdef75975b7e

SHA512
fdac74c09b199efb3bd2f53e8d8e8f591a9b9cfab8a115fae7c98098e1826c7a629134061e67b4a507a170f3a3dd5fe15a74c9e8d1517838c4c9a82f2883317b

Download Submit
memory/2088-11-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2088-34-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads