Analysis
-
max time kernel
61s -
max time network
79s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 16:35
Behavioral task
behavioral1
Sample
CFɸ糬ٸ.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CFɸ糬ٸ.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20221111-en
General
-
Target
CFɸ糬ٸ.exe
-
Size
816KB
-
MD5
39832b7e716e6fb1e7ed5dfec6f1d56a
-
SHA1
e514e3f32f1096fe6e904a6531edd41afa2a7210
-
SHA256
d3845120969975b18d799e6568b49e6970b9124f8d6f80318db711850d8f993f
-
SHA512
a12142e853734d84a1e366f9d0e860aeadb2a4f401001c758384e01440eec5271a9f6aa39ea35f3914274c98ea95aa3f55275245f6dfbab03fee7692b201c9b5
-
SSDEEP
12288:tbQ0KzGSFONFsDG1hAT67tvVKwDIc8GoAEM2roUm:dCbFkFd1hAT+TKwbwM2roUm
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1976-55-0x0000000000400000-0x0000000000690000-memory.dmp vmprotect behavioral1/memory/1976-56-0x0000000000400000-0x0000000000690000-memory.dmp vmprotect behavioral1/memory/1976-59-0x0000000000400000-0x0000000000690000-memory.dmp vmprotect behavioral1/memory/1976-60-0x0000000000400000-0x0000000000690000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
CFɸ糬ٸ.exedescription ioc process File created C:\Windows\SysWOW64\PastB5MhG.sys CFɸ糬ٸ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
CFɸ糬ٸ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kcffeige" CFɸ糬ٸ.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
CFɸ糬ٸ.exepid process 1976 CFɸ糬ٸ.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 460 460 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
CFɸ糬ٸ.exepid process 1976 CFɸ糬ٸ.exe 1976 CFɸ糬ٸ.exe 1976 CFɸ糬ٸ.exe 1976 CFɸ糬ٸ.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1976-54-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB
-
memory/1976-55-0x0000000000400000-0x0000000000690000-memory.dmpFilesize
2.6MB
-
memory/1976-56-0x0000000000400000-0x0000000000690000-memory.dmpFilesize
2.6MB
-
memory/1976-59-0x0000000000400000-0x0000000000690000-memory.dmpFilesize
2.6MB
-
memory/1976-60-0x0000000000400000-0x0000000000690000-memory.dmpFilesize
2.6MB