ef7df42117159f14e01df0b453d93b13a1f938853cfd43bd30f90d32eb133dc1

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
Size

424KB
MD5

6d9d4848a4ce0932b8c1d1e49c6e5680
SHA1

c08fc38b827dda79fc41d448d1aa4165fe7c9e8c
SHA256

ef7df42117159f14e01df0b453d93b13a1f938853cfd43bd30f90d32eb133dc1
SHA512

8b88991dfc6513ba2514543e954c7ab60087845c59ad5cf8192a4bceb51f3788134dcf507dbba3addd9c8fb958c8ccb0390f57f59da0258d2537483696ff5b7b
SSDEEP

3072:LmVW8iTX/3Rfl8Xq1+0cxxsWEL02fXcIp08Moe9DESZLNF7SbvFP:SM7jJljxYTHYZM1vibl

Score

7^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4124-0-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/files/0x0007000000023491-6.dat	upx
behavioral2/memory/4124-34-0x0000000000400000-0x0000000000468000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\yahoo cracker.exe	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\career girls playing with their snatch after work.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\sexy amatures sucking whole bag.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\hard cock cumming in her mouth.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\ass ripping interracial fuckin.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\gay super heros and fairys.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\horny housewife looking for some action.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\two busty sluts fucked in bathroom.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\leggy babe posing in pink panties.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\babe doing boyfriend and his buddy.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - adriana.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\kitty-cat with horny beaver that needs licking.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\hot busty amateur babe stripping and spreading.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\trailor tramp pissing for you.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\pretty babe sucking cock on bed.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\gorgious babe who quit school to model pretty pink.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\blonde babe handfucking herself.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\candy stripper getting down on sick mans cock.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\amateur babe showing pink.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\robin throating and fucking.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\lesbians lickin and toying.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\violent preteen gang bang illegal.mpg.exe	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
File created	C:\Windows\SysWOW64\macromd\fine babe spreading extremely hot ass and furball.mpg.pif	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d9d4848a4ce0932b8c1d1e49c6e5680N.exe

C:\Users\Admin\AppData\Local\Temp\6d9d4848a4ce0932b8c1d1e49c6e5680N.exe
"C:\Users\Admin\AppData\Local\Temp\6d9d4848a4ce0932b8c1d1e49c6e5680N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe

Filesize
85KB

MD5
fd383e03eedf0d716d7cd05e24820560

SHA1
e062795d603c0f34683eb7908b1c55e2c89ed96c

SHA256
c1c333a30226c52086781b14168cff16e57e4d679e8f2b3e1c501a552caac4aa

SHA512
9fc6775a961151f6ea8f15d0fa98b25f8d93100221b49fb94896b96b5c523f12cc5eaf7d2002bc86e470eb193535859fde010972355cba6874bfce75b203a6a6

Download Submit
memory/4124-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4124-34-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads