Analysis
-
max time kernel
139s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
08/02/2023, 00:47
General
-
Target
rufus-3.21.exe
-
Size
1.3MB
-
MD5
c2ab67a2561ac7f5add3256fe9bf85d4
-
SHA1
cc5742d1f128c439740a56734c0e105f11a62fe6
-
SHA256
d0554f1fc47407d678a4d8eace607272013c475033b636bfb1824ed6b1a22e36
-
SHA512
936ffc79313ebd47ad41f13c5e922d77f4d58c43f0c4df3daf3caff06bf8ca0cb2586c63c685b1c60ffe9d24ce1815ea2fe02d09e4618ba7cef897dffaa01467
-
SSDEEP
24576:3sqLY/SQe/JGy8U6epCdC4B4K8cvKBUlrVI3r+B4lz/i/ywNRhjSFOA:jYARGyLmCq4VciKlr2b+EjmzSN
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-3.21.exe"C:\Users\Admin\AppData\Local\Temp\rufus-3.21.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.9MB
-
Filesize
8KB
-
Filesize
3.9MB