Overview
overview
6Static
static
3net6.0-win...PC.dll
windows11-21h2-x64
1net6.0-win...on.exe
windows11-21h2-x64
1net6.0-win...on.exe
windows11-21h2-x64
6net6.0-win...er.dll
windows11-21h2-x64
net6.0-win...ls.dll
windows11-21h2-x64
1net6.0-win...pf.dll
windows11-21h2-x64
1net6.0-win...on.dll
windows11-21h2-x64
1net6.0-win...rp.dll
windows11-21h2-x64
1net6.0-win...gs.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1net6.0-win...es.dll
windows11-21h2-x64
1Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-01-2024 22:22
Static task
static1
Behavioral task
behavioral1
Sample
net6.0-windows/DiscordRPC.dll
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
net6.0-windows/Fusion.exe
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
net6.0-windows/Fusion.exe
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
net6.0-windows/INIFileParser.dll
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
net6.0-windows/ModernWpf.Controls.dll
Resource
win11-20231215-en
Behavioral task
behavioral6
Sample
net6.0-windows/ModernWpf.dll
Resource
win11-20231215-en
Behavioral task
behavioral7
Sample
net6.0-windows/Newtonsoft.Json.dll
Resource
win11-20231215-en
Behavioral task
behavioral8
Sample
net6.0-windows/SevenZipSharp.dll
Resource
win11-20231215-en
Behavioral task
behavioral9
Sample
net6.0-windows/WindowsAPICodePack.Shell.CommonFileDialogs.dll
Resource
win11-20231215-en
Behavioral task
behavioral10
Sample
net6.0-windows/af-ZA/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral11
Sample
net6.0-windows/af-ZA/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral12
Sample
net6.0-windows/am-ET/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral13
Sample
net6.0-windows/am-ET/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral14
Sample
net6.0-windows/ar-SA/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral15
Sample
net6.0-windows/ar-SA/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral16
Sample
net6.0-windows/az-Latn-AZ/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral17
Sample
net6.0-windows/az-Latn-AZ/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral18
Sample
net6.0-windows/be-BY/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral19
Sample
net6.0-windows/be-BY/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral20
Sample
net6.0-windows/bg-BG/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral21
Sample
net6.0-windows/bg-BG/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral22
Sample
net6.0-windows/bn-BD/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral23
Sample
net6.0-windows/bn-BD/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral24
Sample
net6.0-windows/bs-Latn-BA/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral25
Sample
net6.0-windows/bs-Latn-BA/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral26
Sample
net6.0-windows/ca-ES/ModernWpf.Controls.resources.dll
Resource
win11-20231222-en
Behavioral task
behavioral27
Sample
net6.0-windows/ca-ES/ModernWpf.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral28
Sample
net6.0-windows/cs-CZ/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral29
Sample
net6.0-windows/cs-CZ/ModernWpf.resources.dll
Resource
win11-20231222-en
Behavioral task
behavioral30
Sample
net6.0-windows/da-DK/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
Behavioral task
behavioral31
Sample
net6.0-windows/da-DK/ModernWpf.resources.dll
Resource
win11-20231222-en
Behavioral task
behavioral32
Sample
net6.0-windows/de-DE/ModernWpf.Controls.resources.dll
Resource
win11-20231215-en
General
-
Target
net6.0-windows/Fusion.exe
-
Size
295KB
-
MD5
0ff860e98fc44f9cae9850c4393fffaa
-
SHA1
6de30fcd2925b54368e3eed5d1110889b5ba7455
-
SHA256
5cc2d715572b86faf85153db9f63a3c29fef5615c88ab9a284824f414ce99c0d
-
SHA512
1a7a65bcfd27386d7e9707e84491375a8c3f15ddabb0b26224b77e7c878b89525836bb5ce640223b728e66ddac918044d79350332f843e1b953e3bd2c015be69
-
SSDEEP
6144:XA4NCmBPry/N2KOODich9SkEfowBogYp22FsS3BBe0R:XhNAl24rEfowNYAGBe0
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies Control Panel 1 IoCs
Processes:
Fusion.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000\Control Panel\Colors Fusion.exe -
Modifies registry class 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2201820139-2432375203-2549035866-1000\{E368C8FD-3DAC-45C0-A52D-07A8976FC479} svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3876 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\net6.0-windows\Fusion.exe"C:\Users\Admin\AppData\Local\Temp\net6.0-windows\Fusion.exe"1⤵
- Modifies Control Panel
PID:5744
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c