Resubmissions

08/07/2025, 08:09

250708-j16kvavwcx 10

04/07/2025, 04:30

250704-e483xsap8v 10

13/05/2024, 10:29

240513-mjfjwabd28 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 10:29

General

  • Target

    WORM_VOBFUS.exe

  • Size

    188KB

  • MD5

    634aa845f5b0b519b6d8a8670b994906

  • SHA1

    82ad537a7acb18702a02b6dd2c6d12eaac0b3656

  • SHA256

    7f7e5751277a0169ec2eb4492b0489ca850808f64b52e708f716f46ac160e54b

  • SHA512

    63a72331fed9c53d593d2b572fc35efe24eb9d5d292cbe891765926de60987fefa0ddc95aa9037384e45f52015ef075c4ce9aaf9bd297e4e437f606104257cbf

  • SSDEEP

    3072:dzimFU1cIsisNUbaxF6qJDe94aqosAm+w90Z69:tisYGDe94aqosAm+w90C

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe
    "C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\yajip.exe
      "C:\Users\Admin\yajip.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4716

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\yajip.exe

          Filesize

          188KB

          MD5

          cd2e36438b8189e3417a1e121c64dfe9

          SHA1

          8b538409de05379228baac00275c0fe9aa7acd29

          SHA256

          cc920df09426c1cbeb030b36288cc4d90edea5580ee0438cd1256da8a67ea7f2

          SHA512

          59619b2aa41787d4be77ae922ac301849b2d64955fdaa77a25896d589415a14e573ba3abc793227c406e97ed01d68f7c37230df2c33a0523800fcf1084af0a72