6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
Size

80KB
MD5

68a0e6757d968679551861d0019bdb00
SHA1

5591bdfff1ce6132aa565e522e8bfec4a558586a
SHA256

6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298
SHA512

6f4cd4aff1bb495d1506eb19934704a01bb91406aa36db53fb7c030d05bef6fb140ee2ce553c60bafdb428aa8357c91b833871a530db1319026d59ba9226db60
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMS/jhFtR+hwaW:5JjcF8KfCOcjk+guPVjS5wO

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\toying blonde with fucking machine.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\chicks eating hot meaty pussy.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\nice ass penetration and suck.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\cutie who became addicted to dildo and fired her lover.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\spread blonde with woolly pussy.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\shy teen draining the juice from 2 cocks.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\some painfully deep fist insertions.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\sexy little bitch playing with dildo.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\sexy teen lesbians licking pussy.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\prego housewifes large hole .mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\amateur orgy at a swinger party.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\supermodel nina brosh .mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\horny ass licking lesbians.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\fine babe spreading sweet ass and luscious cunt.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\ultra hot ass penetration.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\busty babe on a balcony.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\Play Games Online For FREE.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\amateur slut fingering herself threw her wet panties.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\fistfucking and how ide it goes.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\hot anita blonde doing lesbo.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\trannie posing as a princess.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\fun slut who let dude eat her off in jacuzzi.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\teen with her legs wide and fingers in her wet cunt.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\Two girls - Blonde and Brunette - Giving head.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\busty older bitch gets slammed.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\Winzip.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\2 old heshes playing with each other.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\two studs fucking the hell out of a slut from behind.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1868-4-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/files/0x00090000000191ad-6.dat	upx
behavioral1/memory/1868-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe

C:\Users\Admin\AppData\Local\Temp\6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
"C:\Users\Admin\AppData\Local\Temp\6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe

Filesize
86KB

MD5
300fe1a0b33f0049ef8cfaac23968782

SHA1
44ad491edd896d0ec1734ed091c42774ac8aef14

SHA256
9809f5d845681405fdda895584606ed28949a625ffeea2f2eca0041a7d7b1f30

SHA512
84d6a8274c60e255d682a8958c56ed35aaf021f3424d0b68e257926a6ee389b37d3020e7b544bf3c735394b7e0b461d0fa6e7f2d12eebf4cb7d29c267d32c9b8

Download Submit
memory/1868-4-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1868-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads