f0990cdd2d4bb582aaaa2c02903d13e3702e9cf8bd6ea102245ffd75d8511b67

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

卡巴key挖掘机2.7/卡巴斯基key挖掘机2.7.exe
Size

562KB
MD5

cc0b4618f30a544fc3c5a0e873d976e5
SHA1

ed7596e2119369e6e38b6765885e9f4a95367cee
SHA256

fe2e4d11249e7a57c6fc749def0535ac98a7fe85f2b8b2dc5046224a7a320554
SHA512

5f37b91af730edec290f54d087f28da1a256328481a6c119a3bc1a30860329e771e829ef18736fecd1bee30ecc2cc0131e96383550138746a4f7ff37746d1117
SSDEEP

12288:VtPK4fBujDJ+IRRE1sc2EMVgucf8D6DPY/o7RA6br:Vw4fEVPWsc2EWTqDDPwodtb

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2932-0-0x0000000000400000-0x0000000000587000-memory.dmp	upx
behavioral3/memory/2932-2-0x0000000001F80000-0x0000000001FBC000-memory.dmp	upx
behavioral3/memory/2932-29-0x0000000000400000-0x0000000000587000-memory.dmp	upx
behavioral3/memory/2932-30-0x0000000001F80000-0x0000000001FBC000-memory.dmp	upx
behavioral3/memory/2932-32-0x0000000001F80000-0x0000000001FBC000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	卡巴斯基key挖掘机2.7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	卡巴斯基key挖掘机2.7.exe
2932	卡巴斯基key挖掘机2.7.exe

C:\Users\Admin\AppData\Local\Temp\卡巴key挖掘机2.7\卡巴斯基key挖掘机2.7.exe
"C:\Users\Admin\AppData\Local\Temp\卡巴key挖掘机2.7\卡巴斯基key挖掘机2.7.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2932-0-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2932-2-0x0000000001F80000-0x0000000001FBC000-memory.dmp

Filesize
240KB

Download
memory/2932-29-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2932-30-0x0000000001F80000-0x0000000001FBC000-memory.dmp

Filesize
240KB

Download
memory/2932-32-0x0000000001F80000-0x0000000001FBC000-memory.dmp

Filesize
240KB

Download
memory/2932-33-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download