e4cf09e194478fe72f53d9a2b54be8f1ff6a383fb6d5115a394cbc54f347aa2b

Analysis

max time kernel
32s
max time network
68s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf[]Զǹ+ʮ׼[޸]/cf��.exe
Size

44KB
MD5

2ddd1c11b0bab48b6493dcebbf085c03
SHA1

d022ca5bc6953456721c0fb12e44d02d583df932
SHA256

805e3bac58b532f84e41c65a4e47114656c6c9ea7490728e54c59204c1ad7867
SHA512

28408f258ca67b533b15676c61afa263b8d0ea79b51e0a911e140c896be4c5f2ffa259705e2ff46dcc7f23151c76d5184fcbb88c7b8309e17d1d387df67e670f
SSDEEP

768:RtjCjA5eMVH0tTlzM+YnehpInBQmpInBQhk:39h0HuehpopTk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	cf��.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.wj95.com/"	cf��.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1756	cf��.exe
Token: SeBackupPrivilege	1756	cf��.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	cf��.exe

C:\Users\Admin\AppData\Local\Temp\cf[]Զǹ+ʮ׼[޸]\cf��.exe
"C:\Users\Admin\AppData\Local\Temp\cf[]Զǹ+ʮ׼[޸]\cf��.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads