Overview
overview
7Static
static
3_Redist.rar
windows11-21h2-x64
7_Redist/QuickSFV.exe
windows11-21h2-x64
3_Redist/QuickSFV.ini
windows11-21h2-x64
3_Redist/do...64.exe
windows11-21h2-x64
7_Redist/dx...up.exe
windows11-21h2-x64
7_Redist/fitgirl.md5
windows11-21h2-x64
3_Redist/vc...64.exe
windows11-21h2-x64
7_Redist/vc...86.exe
windows11-21h2-x64
7Analysis
-
max time kernel
130s -
max time network
197s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-01-2024 18:50
Static task
static1
Behavioral task
behavioral1
Sample
_Redist.rar
Resource
win11-20231222-en
Behavioral task
behavioral2
Sample
_Redist/QuickSFV.exe
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
_Redist/QuickSFV.ini
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
_Redist/dotNetFx40_Full_x86_x64.exe
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
_Redist/dxwebsetup.exe
Resource
win11-20231215-en
Behavioral task
behavioral6
Sample
_Redist/fitgirl.md5
Resource
win11-20231215-en
Behavioral task
behavioral7
Sample
_Redist/vcredist_x64_2010_sp1_x64.exe
Resource
win11-20231215-en
Behavioral task
behavioral8
Sample
_Redist/vcredist_x86_2010_sp1_x86.exe
Resource
win11-20231222-en
General
-
Target
_Redist/fitgirl.md5
-
Size
126KB
-
MD5
d2c75112313b4024bac38c8285f334b2
-
SHA1
618fb3f0bae5d23f531d67c9402126bdd7098521
-
SHA256
366ec9c7df3255fe6a33bb9c3a473d4ae069e0d02bdf6160e7e3f03a0e2a3b3d
-
SHA512
14e7815f10dc483f9154ec855c350f5ce77fb1deed0a56a387ff2c4853d6773c5bf2099e285a4e48084c34f8257ea8d32ca85cb2c57f5c658fee8a790791d44b
-
SSDEEP
3072:apT/vQi/0RV/j54OitJkm/IfjS+KoEYFE:apT/vQi/0RV/j54OiJkm/WS+fW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-334598701-2770630493-3015612279-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-334598701-2770630493-3015612279-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OpenWith.exepid process 3752 OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3752 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_Redist\fitgirl.md51⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx