Resubmissions

08/07/2025, 08:09

250708-j16kvavwcx 10

04/07/2025, 04:30

250704-e483xsap8v 10

13/05/2024, 10:29

240513-mjfjwabd28 10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 10:29

General

  • Target

    WORM_VOBFUS.exe

  • Size

    188KB

  • MD5

    634aa845f5b0b519b6d8a8670b994906

  • SHA1

    82ad537a7acb18702a02b6dd2c6d12eaac0b3656

  • SHA256

    7f7e5751277a0169ec2eb4492b0489ca850808f64b52e708f716f46ac160e54b

  • SHA512

    63a72331fed9c53d593d2b572fc35efe24eb9d5d292cbe891765926de60987fefa0ddc95aa9037384e45f52015ef075c4ce9aaf9bd297e4e437f606104257cbf

  • SSDEEP

    3072:dzimFU1cIsisNUbaxF6qJDe94aqosAm+w90Z69:tisYGDe94aqosAm+w90C

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe
    "C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\neeeha.exe
      "C:\Users\Admin\neeeha.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2968

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\neeeha.exe

          Filesize

          188KB

          MD5

          3ad9cde08bcb6a286532e5e9f6ee5bdf

          SHA1

          a51386e3fed1188531ec5546746b66a59b3b088d

          SHA256

          010cf59aff841dd000bb7697a74abfc0e8f394d2b402a5463515de3ec51530d7

          SHA512

          3910bc0fcd392d70a98ef3658fcd8313b5d6e252ccb07474d478a836142df68c83af5bf47b28586a6b03d79b65711c7d4425e2de0890a7ec3093c0c4093ed080