e678899d7ea9702184167b56655f91a69f8a0bdc9df65612762252c053c2cd7c

General

Target

hfs.exe
Size

2.1MB
MD5

9e8557e98ed1269372ff0ace91d63477
SHA1

d0c4192b65e36553f6fd2b83f3123f6ae8380dac
SHA256

e678899d7ea9702184167b56655f91a69f8a0bdc9df65612762252c053c2cd7c
SHA512

c1a338c0414ac68d7ce24df06f3b665a56feae15063332324fea3250f1e77c19209ea3d89fe3a06d48974cce70bd9c65d59b7e2fbaf27c3f01ac2e898057e9ec
SSDEEP

49152:UR0LvNmmh9otEKMx9XSNVBOw+V4UvEbAThhiqvyo98ZcW7SZ:UR0xmmh9GEKgpSNVBr72QN

Score

1^/10

Malware Config

Signatures

Modifies registry class 16 IoCs

Processes:

hfs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Add to HFS	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell\Open\command	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	hfs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\ = "HFS file system"	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Add to HFS\command	hfs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Add to HFS\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hfs.exe\" \"%1\""	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Add to HFS	hfs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Add to HFS\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hfs.exe\" \"%1\""	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell\Open	hfs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hfs.exe\" \"%1\""	hfs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Add to HFS\command	hfs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

hfs.exe

pid process

844 hfs.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

hfs.exe

pid	process
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

hfs.exe

pid	process
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe
844	hfs.exe

C:\Users\Admin\AppData\Local\Temp\hfs.exe
"C:\Users\Admin\AppData\Local\Temp\hfs.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/844-1-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-5-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-6-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/844-7-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-9-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-10-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-11-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-12-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-13-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-14-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-19-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-20-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-21-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-22-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-23-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-24-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-25-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-26-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-27-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download
memory/844-28-0x0000000000400000-0x0000000000625000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads