Analysis
-
max time kernel
41s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:51
Static task
static1
Behavioral task
behavioral1
Sample
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe
Resource
win10v2004-20221111-en
General
-
Target
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe
-
Size
536KB
-
MD5
50f6658c64530d211d7e0f8e6663c6eb
-
SHA1
b5c232d829eb70751a7771f510ee1d467947225e
-
SHA256
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a
-
SHA512
e682cd7a76192cd9040a0c185b23e77bbdf7c6bc39ff325637011e547738ec9d6b669f1413ee22399fa366b919e7a92e24ccb80a035dd25ea575b1eba6a0c6a5
-
SSDEEP
12288:dvGPHiqZLZ4neftMAYxxoEvCf2IfZ4DGXAJ5Cf:dvGHZLOnYtYfoEKHfZ4DjGf
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exepid process 1448 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmo.exe = "C:\\WINDOWS\\system32\\ctfmo.exe" 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.yepian.com/?5" 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe -
Modifies registry class 1 IoCs
Processes:
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exepid process 1448 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe"C:\Users\Admin\AppData\Local\Temp\6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\E_4\krnln.fnrFilesize
1.0MB
MD5199e87ea6b03e907316560a58f7b51af
SHA18515b7d54e11ba32c52240044164b60b2f112341
SHA2560a0aee69b025f1206af1193b13e0476b49506b7d77ef2ed824ca169cfa749970
SHA5121221b91cad64a7739d2aa676924b87f68aceb66faa0edadd2f7e4fdf51054cae56bd2b846ebf69602fbe180ff0efe0218eb1a342d08ba175105d7b5fd4e4b277
-
memory/1448-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1448-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB