Analysis
-
max time kernel
68s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-02-2023 01:43
Behavioral task
behavioral1
Sample
rufus-3.21.exe
Resource
win7-20220812-en
9 signatures
150 seconds
General
-
Target
rufus-3.21.exe
-
Size
1.3MB
-
MD5
c2ab67a2561ac7f5add3256fe9bf85d4
-
SHA1
cc5742d1f128c439740a56734c0e105f11a62fe6
-
SHA256
d0554f1fc47407d678a4d8eace607272013c475033b636bfb1824ed6b1a22e36
-
SHA512
936ffc79313ebd47ad41f13c5e922d77f4d58c43f0c4df3daf3caff06bf8ca0cb2586c63c685b1c60ffe9d24ce1815ea2fe02d09e4618ba7cef897dffaa01467
-
SSDEEP
24576:3sqLY/SQe/JGy8U6epCdC4B4K8cvKBUlrVI3r+B4lz/i/ywNRhjSFOA:jYARGyLmCq4VciKlr2b+EjmzSN
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2044-55-0x0000000000E20000-0x0000000001206000-memory.dmp upx behavioral1/memory/2044-57-0x0000000000E20000-0x0000000001206000-memory.dmp upx -
Processes:
rufus-3.21.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rufus-3.21.exe -
Drops file in System32 directory 5 IoCs
Processes:
rufus-3.21.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rufus-3.21.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rufus-3.21.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol rufus-3.21.exe File opened for modification C:\Windows\System32\GroupPolicy rufus-3.21.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini rufus-3.21.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 32 IoCs
Processes:
rufus-3.21.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 rufus-3.21.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" rufus-3.21.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff rufus-3.21.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 rufus-3.21.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell rufus-3.21.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rufus-3.21.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} rufus-3.21.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rufus-3.21.exepid process 2044 rufus-3.21.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
rufus-3.21.exedescription pid process Token: SeDebugPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe Token: SeLoadDriverPrivilege 2044 rufus-3.21.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rufus-3.21.exepid process 2044 rufus-3.21.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rufus-3.21.exepid process 2044 rufus-3.21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-3.21.exe"C:\Users\Admin\AppData\Local\Temp\rufus-3.21.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2044-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/2044-55-0x0000000000E20000-0x0000000001206000-memory.dmpFilesize
3.9MB
-
memory/2044-56-0x0000000074661000-0x0000000074663000-memory.dmpFilesize
8KB
-
memory/2044-57-0x0000000000E20000-0x0000000001206000-memory.dmpFilesize
3.9MB