Analysis
-
max time kernel
30s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 23:27
General
-
Target
CF天心简洁版全能工具Vc2.exe
-
Size
1.8MB
-
MD5
9a3aad8d873e636505269ded79d3c7d6
-
SHA1
063b45f33c3dc5a3d7b91f322fdc7da09f8fbb34
-
SHA256
5673aba18908dc2eca8ca9b32ea95f50245c5b6c992e1532268949aa08bb90d4
-
SHA512
b40f8f625ded22fd99610c15d3aa609647017604b5270f3cbae9439223c6b4e2d989c62f8e3d5b22a040a6543eb2aef79689a0a866cdd42570d4efadb8f8c96f
-
SSDEEP
49152:+pSiaMcB3SjvtzeItQPerQ6RmtMRDlfkNfv0qDK5:+pSppBiJzhQPe/Dlfk9v0qe5
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CF天心简洁版全能工具Vc2.exe"C:\Users\Admin\AppData\Local\Temp\CF天心简洁版全能工具Vc2.exe"1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 4282⤵
- Program crash
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-