c61eb03a7250c27d1a4dc89e280d22d0b8051c95a0ba41b126055fbbedab9430

Analysis

max time kernel
190s
max time network
279s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CF߱ѪٷȫܸSP566_se.exe
Size

2.7MB
MD5

5ecfaebbe0d10a4ba347e6e6142f8a27
SHA1

8293651b16bbee12429eddb4e2a696d111833d55
SHA256

57ef54f6352247008e3d56fe74d547f986ee1d13840099f2a11ffe00ca535e4c
SHA512

39a3425c2ab67266fa4f9c5ddf81ad1b3662b6973d827f857525b30a06a6e427e05fd88a768ed2c3f1c02a54e1d48ba92774de32baeff1d1298a6eb565d52317
SSDEEP

49152:hiFVFu7OVJ2+gjPMA/wNo2eVaA6GOhFMMMIBvx/Q8WRbWgHgizQBv7gOm07zlp4S:h4wqJWMAIKxVbynMMMIBvx/9kbWgAv7f

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

yyboswe.exe

pid process

1684 yyboswe.exe
Loads dropped DLL 2 IoCs

Processes:

CF߱ѪٷȫܸSP566_se.exe

pid process

1488 CF߱ѪٷȫܸSP566_se.exe
1488 CF߱ѪٷȫܸSP566_se.exe

pid	process
1684	yyboswe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CF߱ѪٷȫܸSP566_se.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÎÒµÄÆô¶¯Ïî = "C:\\Windows\\system32\\/yyboswe.exe"	CF߱ѪٷȫܸSP566_se.exe

Drops file in System32 directory 1 IoCs

Processes:

CF߱ѪٷȫܸSP566_se.exe

description ioc process

File created C:\Windows\SysWOW64\yyboswe.exe CF߱ѪٷȫܸSP566_se.exe

description	ioc	process
File created	C:\Windows\SysWOW64\yyboswe.exe	CF߱ѪٷȫܸSP566_se.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

Processes:

CF߱ѪٷȫܸSP566_se.exe

pid	process
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

CF߱ѪٷȫܸSP566_se.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	CF߱ѪٷȫܸSP566_se.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

CF߱ѪٷȫܸSP566_se.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.2345.com/?keyybc"	CF߱ѪٷȫܸSP566_se.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

CF߱ѪٷȫܸSP566_se.exe

pid process

1488 CF߱ѪٷȫܸSP566_se.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

CF߱ѪٷȫܸSP566_se.exeyyboswe.exe

pid	process
1488	CF߱ѪٷȫܸSP566_se.exe
1488	CF߱ѪٷȫܸSP566_se.exe
1684	yyboswe.exe
1684	yyboswe.exe
1684	yyboswe.exe
1684	yyboswe.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

CF߱ѪٷȫܸSP566_se.exe

description	pid	process	target process
PID 1488 wrote to memory of 1684	1488	CF߱ѪٷȫܸSP566_se.exe	yyboswe.exe
PID 1488 wrote to memory of 1684	1488	CF߱ѪٷȫܸSP566_se.exe	yyboswe.exe
PID 1488 wrote to memory of 1684	1488	CF߱ѪٷȫܸSP566_se.exe	yyboswe.exe
PID 1488 wrote to memory of 1684	1488	CF߱ѪٷȫܸSP566_se.exe	yyboswe.exe

C:\Users\Admin\AppData\Local\Temp\CF߱ѪٷȫܸSP566_se.exe
"C:\Users\Admin\AppData\Local\Temp\CF߱ѪٷȫܸSP566_se.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\yyboswe.exe
C:\Windows\system32\/yyboswe.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\yyboswe.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
\Windows\SysWOW64\yyboswe.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
\Windows\SysWOW64\yyboswe.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
memory/1488-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x0000000000400000-0x00000000008C7000-memory.dmp

Filesize
4.8MB

Download
memory/1488-57-0x0000000075C90000-0x0000000075CD7000-memory.dmp

Filesize
284KB

Download
memory/1488-464-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-463-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-465-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-466-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-467-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-468-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-469-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-470-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-471-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-472-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-473-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-474-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-475-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-476-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-477-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-479-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-478-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-480-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-481-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-482-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-483-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-485-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-484-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-486-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-487-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-488-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-489-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-490-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-491-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-492-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-493-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-494-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-495-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-496-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-497-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-498-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-499-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-500-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-501-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-503-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-502-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-504-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-507-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-506-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-505-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-509-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-508-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-510-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-512-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-511-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-513-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-514-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-515-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-516-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-517-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-518-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-519-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-520-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-521-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-522-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-523-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-524-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-1331-0x0000000002240000-0x0000000002340000-memory.dmp

Filesize
1024KB

Download
memory/1488-1332-0x0000000002620000-0x00000000027A1000-memory.dmp

Filesize
1.5MB

Download
memory/1488-1962-0x0000000002240000-0x0000000002340000-memory.dmp

Filesize
1024KB

Download
memory/1488-4611-0x00000000028D0000-0x00000000029E1000-memory.dmp

Filesize
1.1MB

Download
memory/1488-4618-0x0000000000400000-0x00000000008C7000-memory.dmp

Filesize
4.8MB

Download
memory/1488-4619-0x00000000027B0000-0x00000000028B1000-memory.dmp

Filesize
1.0MB

Download
memory/1488-4620-0x0000000002340000-0x00000000023E1000-memory.dmp

Filesize
644KB

Download
memory/1488-4622-0x0000000000400000-0x00000000008C7000-memory.dmp

Filesize
4.8MB

Download
memory/1488-4627-0x0000000000400000-0x00000000008C7000-memory.dmp

Filesize
4.8MB

Download
memory/1684-4624-0x0000000000000000-mapping.dmp

Download