b480c87b61c8af8b3141af262d0b82aad50aa21cf0f003089fa58dd49eef856b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cjzg.exe
Size

153KB
MD5

73a75f61df841a33d297f0539ac18adc
SHA1

20728858fa022c10713752af7bef486c2b609102
SHA256

8faf97a32df851e90a4f9fa6782098318af165956f98402f0eaa6a9a30b2ba74
SHA512

dff3f3aa341c3e6ba85b643f3b96c58a6667a135b770452835055f2c63ff3c63ba643256cb8b14a3907d0caaea037bfa04fc5aa33f5b99b8de91a54c0d9d296e
SSDEEP

3072:WVv1vR5mVkqFTi7xkl9u6tjaknVqjAOoBuCVJBH8:WHR5mV1TiyuqnODoRPG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	cjzg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	cjzg.exe
2968	cjzg.exe

C:\Users\Admin\AppData\Local\Temp\cjzg.exe
"C:\Users\Admin\AppData\Local\Temp\cjzg.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-3-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/2968-5-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download