Overview
overview
7Static
static
7FurMark_2....64.zip
windows11-21h2-x64
6FurMark_wi...LA.txt
windows11-21h2-x64
3FurMark_wi...UI.exe
windows11-21h2-x64
1FurMark_wi...ME.txt
windows11-21h2-x64
3FurMark_wi...nf.xml
windows11-21h2-x64
1FurMark_wi...er.exe
windows11-21h2-x64
1FurMark_wi...ts.txt
windows11-21h2-x64
3FurMark_wi...me.txt
windows11-21h2-x64
3FurMark_wi...rk.exe
windows11-21h2-x64
1FurMark_win64/g.dz
windows11-21h2-x64
3FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...LA.txt
windows11-21h2-x64
3FurMark_wi...ME.txt
windows11-21h2-x64
3FurMark_wi...pp.gxl
windows11-21h2-x64
3FurMark_wi...nf.xml
windows11-21h2-x64
1FurMark_wi...me.txt
windows11-21h2-x64
3FurMark_wi...64.exe
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...uz.exe
windows11-21h2-x64
7FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...64.dll
windows11-21h2-x64
1FurMark_wi...rk.bat
windows11-21h2-x64
1FurMark_wi...es.bat
windows11-21h2-x64
1FurMark_wi...en.bat
windows11-21h2-x64
1FurMark_wi...st.bat
windows11-21h2-x64
1FurMark_wi...st.bat
windows11-21h2-x64
1Analysis
-
max time kernel
452s -
max time network
1172s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/06/2024, 05:18
Behavioral task
behavioral1
Sample
FurMark_2.3.0.0_win64.zip
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
FurMark_win64/EULA.txt
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
FurMark_win64/FurMark_GUI.exe
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
FurMark_win64/README.txt
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
FurMark_win64/conf.xml
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
FurMark_win64/cpuburner/cpuburner.exe
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
FurMark_win64/credits.txt
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
FurMark_win64/exports/_readme.txt
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
FurMark_win64/furmark.exe
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
FurMark_win64/g.dz
Resource
win11-20240419-en
Behavioral task
behavioral11
Sample
FurMark_win64/gpumagick_sdk_x64.dll
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
FurMark_win64/gpushark/EULA.txt
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
FurMark_win64/gpushark/README.txt
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
FurMark_win64/gpushark/app.gxl
Resource
win11-20240611-en
Behavioral task
behavioral15
Sample
FurMark_win64/gpushark/conf.xml
Resource
win11-20240611-en
Behavioral task
behavioral16
Sample
FurMark_win64/gpushark/exports/_readme.txt
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
FurMark_win64/gpushark/gpushark_x64.exe
Resource
win11-20240611-en
Behavioral task
behavioral18
Sample
FurMark_win64/gpushark/gxc_x64.dll
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
FurMark_win64/gpushark/gxl_x64.dll
Resource
win11-20240611-en
Behavioral task
behavioral20
Sample
FurMark_win64/gpushark/plugins/plugin_gxc_gpumon_x64.dll
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
FurMark_win64/gpushark/plugins/plugin_gxc_vulkan2_x64.dll
Resource
win11-20240419-en
Behavioral task
behavioral22
Sample
FurMark_win64/gpuz/gpuz.exe
Resource
win11-20240611-en
Behavioral task
behavioral23
Sample
FurMark_win64/gxc_x64.dll
Resource
win11-20240611-en
Behavioral task
behavioral24
Sample
FurMark_win64/gxl_x64.dll
Resource
win11-20240611-en
Behavioral task
behavioral25
Sample
FurMark_win64/plugins/plugin_gxc_as_x64.dll
Resource
win11-20240611-en
Behavioral task
behavioral26
Sample
FurMark_win64/plugins/plugin_gxc_gpumon_x64.dll
Resource
win11-20240508-en
Behavioral task
behavioral27
Sample
FurMark_win64/plugins/plugin_gxc_vulkan2_x64.dll
Resource
win11-20240508-en
Behavioral task
behavioral28
Sample
FurMark_win64/start_benchmark.bat
Resource
win11-20240508-en
Behavioral task
behavioral29
Sample
FurMark_win64/start_examples.bat
Resource
win11-20240508-en
Behavioral task
behavioral30
Sample
FurMark_win64/start_fullscreen.bat
Resource
win11-20240611-en
Behavioral task
behavioral31
Sample
FurMark_win64/start_vram_test.bat
Resource
win11-20240508-en
Behavioral task
behavioral32
Sample
FurMark_win64/vram_test.bat
Resource
win11-20240611-en
General
-
Target
FurMark_win64/conf.xml
-
Size
137B
-
MD5
6f89cc3724d087c8223bd50df290185e
-
SHA1
aac3d460fc2b3c6b99ac705a7090a7ce931b2f7f
-
SHA256
9fc196fe75343a7ab61ca39f5505efa6215a80e14a05a1407ec4b90e4c01d727
-
SHA512
51cc2ed0dc4fda6bd13328e5985a6657e308b46aaf2543b79ba839088a5f90efd4e3659d7ddbdc42861c3808f7cbcad566951689ff561c27bb991a21d01770a7
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2678715941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31114983" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4576 wrote to memory of 1532 4576 MSOXMLED.EXE 77 PID 4576 wrote to memory of 1532 4576 MSOXMLED.EXE 77
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\FurMark_win64\conf.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FurMark_win64\conf.xml2⤵
- Modifies Internet Explorer settings
PID:1532
-