8ac9e1b2a8bab6ef578a8c0a0c96fa2c0646f8f920975ee9b04425e7cd4ee1f5

Analysis

max time kernel
128s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CFɸ糬ٸ.exe
Size

816KB
MD5

39832b7e716e6fb1e7ed5dfec6f1d56a
SHA1

e514e3f32f1096fe6e904a6531edd41afa2a7210
SHA256

d3845120969975b18d799e6568b49e6970b9124f8d6f80318db711850d8f993f
SHA512

a12142e853734d84a1e366f9d0e860aeadb2a4f401001c758384e01440eec5271a9f6aa39ea35f3914274c98ea95aa3f55275245f6dfbab03fee7692b201c9b5
SSDEEP

12288:tbQ0KzGSFONFsDG1hAT67tvVKwDIc8GoAEM2roUm:dCbFkFd1hAT+TKwbwM2roUm

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/4992-132-0x0000000000400000-0x0000000000690000-memory.dmp	vmprotect
behavioral2/memory/4992-135-0x0000000000400000-0x0000000000690000-memory.dmp	vmprotect
behavioral2/memory/4992-136-0x0000000000400000-0x0000000000690000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

Processes:

CFɸ糬ٸ.exe

description ioc process

File created C:\Windows\SysWOW64\Past4SDzH.sys CFɸ糬ٸ.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\SysWOW64\Past4SDzH.sys	CFɸ糬ٸ.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

CFɸ糬ٸ.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kcffeige"	CFɸ糬ٸ.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CFɸ糬ٸ.exe

pid process

4992 CFɸ糬ٸ.exe
4992 CFɸ糬ٸ.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

672
672

pid	process
672
672

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

CFɸ糬ٸ.exe

pid	process
4992	CFɸ糬ٸ.exe
4992	CFɸ糬ٸ.exe
4992	CFɸ糬ٸ.exe
4992	CFɸ糬ٸ.exe

C:\Users\Admin\AppData\Local\Temp\CFɸ糬ٸ.exe
"C:\Users\Admin\AppData\Local\Temp\CFɸ糬ٸ.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-132-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/4992-135-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/4992-136-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download