Overview
overview
3Static
static
3CCProxy/CCProxy.dll
windows7-x64
1CCProxy/CCProxy.dll
windows10-2004-x64
1CCProxy/CCProxy.exe
windows7-x64
1CCProxy/CCProxy.exe
windows10-2004-x64
1CCProxy/we...fo.htm
windows7-x64
1CCProxy/we...fo.htm
windows10-2004-x64
1CCProxy/we...in.htm
windows7-x64
1CCProxy/we...in.htm
windows10-2004-x64
1CCProxy/we...er.htm
windows7-x64
1CCProxy/we...er.htm
windows10-2004-x64
1CCProxy/we...in.htm
windows7-x64
1CCProxy/we...in.htm
windows10-2004-x64
1CCProxy/we...er.htm
windows7-x64
1CCProxy/we...er.htm
windows10-2004-x64
1CCProxy/zlib1.dll
windows7-x64
3CCProxy/zlib1.dll
windows10-2004-x64
3易网时�...��.url
windows7-x64
1易网时�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
CCProxy/CCProxy.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
CCProxy/CCProxy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
CCProxy/CCProxy.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
CCProxy/CCProxy.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
CCProxy/web/accinfo.htm
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
CCProxy/web/accinfo.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
CCProxy/web/cn_acclistadmin.htm
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
CCProxy/web/cn_acclistadmin.htm
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
CCProxy/web/cn_acclistuser.htm
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
CCProxy/web/cn_acclistuser.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
CCProxy/web/en_acclistadmin.htm
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
CCProxy/web/en_acclistadmin.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
CCProxy/web/en_acclistuser.htm
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
CCProxy/web/en_acclistuser.htm
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
CCProxy/zlib1.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
CCProxy/zlib1.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
易网时代绿软基地.url
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
易网时代绿软基地.url
Resource
win10v2004-20240508-en
General
-
Target
CCProxy/CCProxy.exe
-
Size
1024KB
-
MD5
90681e43359f4dd17a61ba564b59c43f
-
SHA1
bd44d19c72d182d80f96a39f5ce9381b861cb130
-
SHA256
5377355cc0e80fb5d0a3aeb3fdc85bf7cf768c1a6a73eee8d3da1e4913827829
-
SHA512
fa6cf61061fce5c69dac5007dc7b7a9a306dc67b0304409e500c6777c39c0bd5efffcd6855b7a20ab009647268e21deff7be14dc4eeeeeaa83a5b068b3e5f585
-
SSDEEP
12288:QH/LlV2f4oIFPpXLLDJRuL3ZM3jy34brPNzSTxqptqgeYcqUQPlN0yEJoUnUKkzb:G/LlIgoI/r9BGTcegcLQPMoyUlz8A
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CCProxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CCProxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier CCProxy.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe 212 CCProxy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 212 CCProxy.exe 212 CCProxy.exe