Overview
overview
10Static
static
3AMI/AMIDEWINx64.exe
windows10-2004-x64
1AMI/amigendrv64.sys
windows10-2004-x64
1AMI/spoof.bat
windows10-2004-x64
1Insyde/H2O...64.exe
windows10-2004-x64
Insyde/segwindrv.cat
windows10-2004-x64
8Insyde/segwindrv.inf
windows10-2004-x64
1Insyde/seg...64.sys
windows10-2004-x64
1Insyde/spoof.bat
windows10-2004-x64
VHD/1.txt
windows10-2004-x64
1VHD/VHD.bat
windows10-2004-x64
1check.bat
windows10-2004-x64
5tweaks/1.bat
windows10-2004-x64
10tweaks/1.reg
windows10-2004-x64
10Analysis
- max time kernel
135s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
AMI/AMIDEWINx64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
AMI/amigendrv64.sys
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
AMI/spoof.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
Insyde/H2OSDE-Wx64.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Insyde/segwindrv.cat
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
Insyde/segwindrv.inf
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Insyde/segwindrvx64.sys
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
Insyde/spoof.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
VHD/1.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
VHD/VHD.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
check.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
tweaks/1.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
tweaks/1.reg
Resource
win10v2004-20240426-en
General
- Target Insyde/segwindrv.cat
- Size 10KB
- Sample240528-mexmlage85
- SHA256 e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
- MD5 43d3603cf918445cbd1d7253b49bf527
- SHA1 fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
- SHA512 183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e
- SSDEEP 192:nPv5lU3j25JC5NFvE4uyK6iWPFWQFe8imCLqnajvdjA/2T:n35mFhiWPFRDKLljdjcM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 4 2064 rundll32.exe