6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
Size

80KB
MD5

68a0e6757d968679551861d0019bdb00
SHA1

5591bdfff1ce6132aa565e522e8bfec4a558586a
SHA256

6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298
SHA512

6f4cd4aff1bb495d1506eb19934704a01bb91406aa36db53fb7c030d05bef6fb140ee2ce553c60bafdb428aa8357c91b833871a530db1319026d59ba9226db60
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMS/jhFtR+hwaW:5JjcF8KfCOcjk+guPVjS5wO

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\violent preteen gang bang illegal.mpg.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\amateur orgy at a swinger party.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\girls with cock in hand and mouths fill with cum .mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\blowjob girl getting a sloppy facial.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - adriana.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\honie with a ka-boom hot ass and delicious cunt.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\hot butt sex ..unbeliveable.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\win2k serial.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\yahoo hacker.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\closeups of horny slut serving up sweet hairy bush.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\nasty slut sucking huge cock.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\MSN.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\hot mature blonde in stockings.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\momma's juggs that make you scream for mercy.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\naturaly tan babe with gorgous body.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\babes taking turns munching on hot beavers.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\babe with dick stuck between her ass cheeks.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\sluts who are in control of their slaves.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\drunk babes sharing a dick.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\supermodel nina brosh .mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\schoolgirl deep sucking some cock.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\two studs gangbanging a hot little sluts holes.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
File created	C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/files/0x00070000000234f5-6.dat	upx
behavioral2/memory/1948-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe

C:\Users\Admin\AppData\Local\Temp\6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe
"C:\Users\Admin\AppData\Local\Temp\6efb933a9c62d71701ccc113914247bb35f63fba1616475efb6d899650daa298N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\16 year old on beach.exe

Filesize
91KB

MD5
ecb71127171567a88c5914001a1289eb

SHA1
226b5c1218e66b9872606cd6f1cbbf42f5ca8229

SHA256
336fa21f478e9d5871a4c957b51aeec59a26d2fda278a1f6c5f49d67e43a2730

SHA512
8257b3ef67083b764f005fa2fa2857c509199a817ff02a712fd33d0c0a21451e97310823949f6b88188801ff6e098b51fb9c6346c99b12f659ee09318c20478d

Download Submit
memory/1948-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1948-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads