c68beb1d7340185b43dea218e90697e9272b72edd0bc11086a895cfecf8a2578

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
Size

416KB
MD5

c41a6afa1a4d0f6478be00f1d3e0fa10
SHA1

e1d09668a8c560df8c7466028165875f9d061bfd
SHA256

c68beb1d7340185b43dea218e90697e9272b72edd0bc11086a895cfecf8a2578
SHA512

e121af722ec039bc9bf5802a5ccbb14aec4b2211b8ca9d3d61a09c9ce32572376d46df7726fe26a96b6e6c7be0edf637d9db6572f171b5ad787ff0d0b19279dc
SSDEEP

3072:LmVW8iTX/3Rfl8Xq1+0cxxsWEL02fXcIp08Moe9DESZLhnEaWE:SM7jJljxYTHYZM1v5yE

Score

7^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3032-0-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/files/0x000700000002361d-6.dat	upx
behavioral2/memory/3032-34-0x0000000000400000-0x0000000000468000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\old man fucking young blonde teen.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\ebony girl with massive hooters.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\hot butt sex ..unbeliveable.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\spread blonde with woolly pussy.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\two studs gangbanging a hot little sluts holes.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\gorgious babe who quit school to model pretty pink.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\holes fisting to the breaking point.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\cool rooster raiding hen house for hot babes, link city.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\tenderonie who insist her pussy must always be free.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\petite ebony enjoying her joy toy.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\both holes fucked by a massive fucking machin.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\a teen with a thick hairy bush.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\farmgirl that turned into college slut.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\msncracker.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\Digimon.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\some hard sucking and fucking babes.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\hot blonde teen sucking old dick.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\porn account cracker.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\blonde babe handfucking herself.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\anastasia nude.exe	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\horny little blonde spreading pink.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\asian girls stuffed mouth shots.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
File created	C:\Windows\SysWOW64\macromd\girl and her new vibrator.mpg.pif	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c41a6afa1a4d0f6478be00f1d3e0fa10N.exe

C:\Users\Admin\AppData\Local\Temp\c41a6afa1a4d0f6478be00f1d3e0fa10N.exe
"C:\Users\Admin\AppData\Local\Temp\c41a6afa1a4d0f6478be00f1d3e0fa10N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Digimon.exe

Filesize
72KB

MD5
d613c467d608ea724d94f6d1606786eb

SHA1
acb927080c3148079514bfc1e3dc0aa75a6bc14e

SHA256
01055b025aac1a9b366f33efaa137f00cba01427b07b4cad15a04c1106117e49

SHA512
6d3360d229eb13355e13635fb0e782a48776146e19a67546d481a90920ab901273b5813592f9a278dbadb0de02aaf730835910f1154189efd2f916c982b88d1b

Download Submit
memory/3032-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3032-34-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads