82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0

General

Target

82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
Size

69KB
MD5

63f6f61dbd89423f6d483d23a0f4b630
SHA1

35717e7f42975fb64b25975c1c5dcbd3f25fa40a
SHA256

82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0
SHA512

df92853cce234a04bb39348c628e83f4a28b9a9d0f25d2332f0561294c975928c05ab619005af32c967548ce9e73527f848cd1cabdc664b9159fc92d4411d0bb
SSDEEP

1536:y4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4mjJS4pm4oBNhS:y4X6NSyfnpijeYEoIcq4ksitoBNQ

Score

7^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/files/0x0007000000023473-6.dat	upx
behavioral2/memory/4992-28-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\Website Hacker.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Pamela Anderson.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\win2k serial.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\aol password cracker.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\aimhacker.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Want to see a massive horse cock in a tight little teen's pussy.mpg.pif	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Microsoft Office XP (english) key generator.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Napster Clone.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\anastasia nude.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Another bang bus victim forced rape sex cum.mpg.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\aimcracker.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\AIM Flooder.exe	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
File created	C:\Windows\SysWOW64\macromd\Lolita preteen sex.mpeg.pif	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe

C:\Users\Admin\AppData\Local\Temp\82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe
"C:\Users\Admin\AppData\Local\Temp\82ecc0fdac1b750a23be9df5412f999baaac9ececa243d8ba526687860b062a0N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe

Filesize
67KB

MD5
a36a4bd9dcd37762488fe88cfca42068

SHA1
915dad6434349ce8e3dd7b108b9541ec3bc15dc4

SHA256
a1c36f13b6e62e1a88323a515e8826af870977980e9191cc68bd15ed7a8a9088

SHA512
b2eb2f2881c943ab6db65ecb01f2bc4731432324f0fbd95227f4a7ea3ea27f274ef905152e7a18b54183388e4cae41337a7231b42722c47daf42e8f76da16223

Download Submit
memory/4992-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4992-28-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads