Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/07/2026, 18:29
General
- Target CFXBypass.exe
- Size 36KB
- Sample260728-w448easfmd
- SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\CFXBypass.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\11218c31-06be-43f6-b938-f3f29948e5da\background.exe"C:\Users\Admin\AppData\Local\11218c31-06be-43f6-b938-f3f29948e5da\background.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
background.exe
__PSScriptPolicyTest_tjpuk3oy.vz5.ps1
memory/3928-80-0x00007FFC4EDD0000-0x00007FFC4EFC5000-memory.dmp
memory/3928-81-0x0000000140000000-0x000000014028D000-memory.dmp
memory/3928-88-0x000001FBFCCF0000-0x000001FBFCEE5000-memory.dmp
memory/3928-87-0x00007FF6F0320000-0x00007FF6F054A000-memory.dmp
memory/4544-67-0x000000001EC50000-0x000000001EDF9000-memory.dmp
memory/4544-13-0x000000001CF10000-0x000000001CF20000-memory.dmp
memory/4544-8-0x000000001CF10000-0x000000001CF20000-memory.dmp
memory/4544-9-0x0000000002340000-0x0000000002362000-memory.dmp
memory/4544-77-0x000000001CF10000-0x000000001CF20000-memory.dmp
memory/4544-79-0x000000001EC50000-0x000000001EDF9000-memory.dmp
memory/4544-0-0x00000000001B0000-0x00000000001C0000-memory.dmp
memory/4544-11-0x000000001EC50000-0x000000001EDF9000-memory.dmp
memory/4544-12-0x000000001CF10000-0x000000001CF20000-memory.dmp
memory/4544-10-0x000000001CF10000-0x000000001CF20000-memory.dmp