Analysis

  • max time kernel
    144s
  • max time network
    212s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 19:51

General

  • Target

    CF审判者免费刷枪软件[CF2.0新年免费专版].exe

  • Size

    2.1MB

  • MD5

    e6d5e5b09d9d3f7732f392f6970a32ee

  • SHA1

    93ea5d9676d7a87dee9b1a301d9c13283886de0d

  • SHA256

    cbf1a5ad0daba1ccb520db9698ecab1ccd52efe3ecc51b9f60fe46d794468c9c

  • SHA512

    a7d1513c3ddc088ae13492b1a20effcd15f06b53736baf3f0f7dc07ab6d1d7b445dd8bed21cc766ef6faca21dd7836d71b9f96b9f119a5333b7bb0c8a26c09e7

  • SSDEEP

    24576:q89Hojus/FBTaDo+AM3yo3JOCkz7bn0j7I7R+2uXuUS1k+i70MBbVPimhlbgXrmj:qCojusT2Aq5q7zVA2/bBL8pA7I+y

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CF审判者免费刷枪软件[CF2.0新年免费专版].exe
    "C:\Users\Admin\AppData\Local\Temp\CF审判者免费刷枪软件[CF2.0新年免费专版].exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.cftgp.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    551f72d1897377d6be37f383cd03a189

    SHA1

    fe3f07b5bab65dd1235e8d7185224f90d28923f5

    SHA256

    ebfab6ea3ed9882eb4bd70b7320d9f989188f98870adb3451a52cc4ae9d9946f

    SHA512

    6993d68816f9b9dc2df0ffb8f0cdc8132e84710d506a989c63b1b5cf958d7e0bf405e09964424ed1d8022c2359cb11187c345407653e2908029402ad9d15657d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2LL2VGYI.txt

    Filesize

    601B

    MD5

    c9073f01c23e924e4bbd5a7f72ba8cce

    SHA1

    07a56e60e72ee48806829f1ca6959cacb7f8ef7a

    SHA256

    bcedb0332f885b5b928fa34433389ae3fc649db007c77f8c795006d8a2eade51

    SHA512

    5093484185058c15c70b62b4fd599aa40593c7ee7fe6d30ca51c6a35db3350177515d810fc79c7b6317fe61d8994eea03edee9846b25384d58d29563e74a0218

  • memory/1252-72-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-96-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-60-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-62-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-64-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-66-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-70-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-68-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-76-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-74-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-54-0x0000000076381000-0x0000000076383000-memory.dmp

    Filesize

    8KB

  • memory/1252-78-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-57-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-84-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-82-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-88-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-86-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-92-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-94-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-90-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-98-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-80-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-99-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-56-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1252-55-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB