Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
21-05-2024 16:43
General
-
Target
CF2.0逆天辅助.exe
-
Size
6.4MB
-
MD5
2c811d671bb7d3844b3f7fa4ecb6c198
-
SHA1
35c6feb17029681a5882a3a0c686a686e613643f
-
SHA256
8ad2c142a26fce03d99bb6e6e1feab875764cf29e917fca1e0b753a6ba1457a9
-
SHA512
d704f64616ed2599877e5441394882802230cdbaf4e8fe77e5e494b2ccdf52e3dee3465eb07297388c90be4680236a7f496f6d12d3063e80c5bb88560cc8b579
-
SSDEEP
196608:uW/tQLB+2eZx658EzO0MtjnyQRpzzcYANfWxbij78VAzUNM:0LVi9tFJJANfBH8VaUNM
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CF2.0逆天辅助.exe"C:\Users\Admin\AppData\Local\Temp\CF2.0逆天辅助.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx