6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a

Analysis

max time kernel
196s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe
Size

536KB
MD5

50f6658c64530d211d7e0f8e6663c6eb
SHA1

b5c232d829eb70751a7771f510ee1d467947225e
SHA256

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a
SHA512

e682cd7a76192cd9040a0c185b23e77bbdf7c6bc39ff325637011e547738ec9d6b669f1413ee22399fa366b919e7a92e24ccb80a035dd25ea575b1eba6a0c6a5
SSDEEP

12288:dvGPHiqZLZ4neftMAYxxoEvCf2IfZ4DGXAJ5Cf:dvGHZLOnYtYfoEKHfZ4DjGf

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

pid process

1940 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

pid	process
1940	6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmo.exe = "C:\\WINDOWS\\system32\\ctfmo.exe"	6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.yepian.com/?5"	6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

Modifies registry class 1 IoCs

Processes:

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

pid process

1940 6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

pid	process
1940	6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe

C:\Users\Admin\AppData\Local\Temp\6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe
"C:\Users\Admin\AppData\Local\Temp\6c47e5290424d066f70f3040dbb6914d12c9f3502a10daf88eacaa8efdc1517a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr
Filesize
1.0MB

MD5
199e87ea6b03e907316560a58f7b51af

SHA1
8515b7d54e11ba32c52240044164b60b2f112341

SHA256
0a0aee69b025f1206af1193b13e0476b49506b7d77ef2ed824ca169cfa749970

SHA512
1221b91cad64a7739d2aa676924b87f68aceb66faa0edadd2f7e4fdf51054cae56bd2b846ebf69602fbe180ff0efe0218eb1a342d08ba175105d7b5fd4e4b277

Download Submit
memory/1940-132-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1940-134-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download