Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-01-2023 10:38
General
-
Target
rufus-3.13.exe
-
Size
1MB
-
MD5
c844fa688f3aafa80790ecd6a204bbb7
-
SHA1
da498e3e80186ee16620f56a601e19fbdc1f8551
-
SHA256
ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb
-
SHA512
442ab6f55fe3b9b648290d4f4ff6ac6bd3d3fe906936bbb26f7a9b31b52ff02aab6601cf342d3e11f705260585708aff80b45cf40633daf69d41d691d399a4df
-
SSDEEP
24576:PakG2227tNDajxxTL6vpBedHlDW5nROQ7X1yBhpzAn:CtRwajxFL6vpwdHlcg01yB/z
Score
8/10
Malware Config
Signatures
-
UPX packed file ⋅ 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
-
Drops file in System32 directory ⋅ 4 IoCs
-
Checks SCSI registry key(s) ⋅ 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken ⋅ 9 IoCs
-
Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-3.13.exePID:3080"C:\Users\Admin\AppData\Local\Temp\rufus-3.13.exe"Checks whether UAC is enabledDrops file in System32 directoryChecks SCSI registry key(s)Suspicious use of AdjustPrivilegeTokenSuspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exePID:3060C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
-
C:\Windows\system32\svchost.exePID:3724C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
memory/3080-132-0x0000000000DF0000-0x0000000001124000-memory.dmp
-
memory/3080-133-0x0000000000DF0000-0x0000000001124000-memory.dmp
Loading data