Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-01-2023 10:38
General
-
Target
rufus-3.13.exe
-
Size
1.1MB
-
MD5
c844fa688f3aafa80790ecd6a204bbb7
-
SHA1
da498e3e80186ee16620f56a601e19fbdc1f8551
-
SHA256
ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb
-
SHA512
442ab6f55fe3b9b648290d4f4ff6ac6bd3d3fe906936bbb26f7a9b31b52ff02aab6601cf342d3e11f705260585708aff80b45cf40633daf69d41d691d399a4df
-
SSDEEP
24576:PakG2227tNDajxxTL6vpBedHlDW5nROQ7X1yBhpzAn:CtRwajxFL6vpwdHlcg01yB/z
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-3.13.exe"C:\Users\Admin\AppData\Local\Temp\rufus-3.13.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3080-132-0x0000000000DF0000-0x0000000001124000-memory.dmpFilesize
3.2MB
-
memory/3080-133-0x0000000000DF0000-0x0000000001124000-memory.dmpFilesize
3.2MB