Overview
overview
7Static
static
7Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/cmdbkg.exe
windows10-2004-x64
1Akuma/lib/cmdwiz.exe
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
1Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/...kg.exe
windows10-2004-x64
1Akuma/lib/...iz.exe
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
1Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
3Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
3Akuma/lib/...ox.exe
windows10-2004-x64
3Akuma/lib/...ox.exe
windows10-2004-x64
3Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/...kg.exe
windows10-2004-x64
1Akuma/lib/...iz.exe
windows10-2004-x64
1Akuma/lib/...rl.exe
windows10-2004-x64
1Akuma/lib/...rl.exe
windows10-2004-x64
1Akuma/lib/...td.exe
windows10-2004-x64
7Akuma/lib/...64.exe
windows10-2004-x64
7Akuma/lib/...86.exe
windows10-2004-x64
7Akuma/lib/...rl.exe
windows10-2004-x64
1Analysis
-
max time kernel
77s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 19:15
Behavioral task
behavioral1
Sample
Akuma/lib/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
Akuma/lib/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Akuma/lib/bookmarks_parser.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Akuma/lib/cmdbkg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Akuma/lib/cmdwiz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
Akuma/lib/speak/7za/x64/7za.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Akuma/lib/speak/7za/x64/7za.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
Akuma/lib/speak/7za/x64/7zxa.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Akuma/lib/speak/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
Akuma/lib/speak/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Akuma/lib/speak/bookmarks_parser.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Akuma/lib/speak/cmdbkg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Akuma/lib/speak/cmdwiz.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
Akuma/lib/speak/curl/7za/x64/7za.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Akuma/lib/speak/curl/7za/x64/7za.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
Akuma/lib/speak/curl/7za/x64/7zxa.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Akuma/lib/speak/curl/7za/x86/7za.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
Akuma/lib/speak/curl/7za/x86/7za.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Akuma/lib/speak/curl/7za/x86/7zxa.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
Akuma/lib/speak/curl/OpenFileBox.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Akuma/lib/speak/curl/SaveFileBox.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
Akuma/lib/speak/curl/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Akuma/lib/speak/curl/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
Akuma/lib/speak/curl/bookmarks_parser.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Akuma/lib/speak/curl/cmdbkg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
Akuma/lib/speak/curl/cmdwiz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Akuma/lib/speak/curl/curl/x64/curl.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
Akuma/lib/speak/curl/curl/x86/curl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Akuma/lib/speak/curl/speak/extd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Akuma/lib/speak/curl/speak/x64/speak-x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Akuma/lib/speak/curl/speak/x86/speak-x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
Akuma/lib/speak/curl/x64/curl.exe
Resource
win10v2004-20240611-en
General
-
Target
Akuma/lib/speak/curl/OpenFileBox.exe
-
Size
12KB
-
MD5
867ff8be4d59e321f40a5adf1ebafc87
-
SHA1
6417c2a9c8cf513b3bfe68480878640ce4f43e9b
-
SHA256
e30eacc0079eea5f32174fc258a717f5bd6671ca7d44911b7f06361590338793
-
SHA512
a8865d127bf8e5f270cbfe422ce680c6ceb6e744d907b27ba51e84b91302797e9678f46db1d42e8dd4eb918d6135822ead55bae9730d30bef493b3bcaa8d8b01
-
SSDEEP
192:FsqGtf5/Mh0OEFfrF+jcGwp96RiOTmbJr+e:FsqGtlMhvEJ13D6E5B+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = 4a00310000000000da58069a10006c696200380009000400efbeda58069ada58069a2e000000fd330200000007000000000000000000000000000000c4e71b016c0069006200000012000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000a8582e6112004170704461746100400009000400efbea8582e61da58069a2e0000007ee101000000010000000000000000000000000000000cdb3f004100700070004400610074006100000016000000 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0 = 4e00310000000000da58069a10006375726c00003a0009000400efbeda58069ada58069a2e00000045340200000007000000000000000000000000000000b7e7ef006300750072006c00000014000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000a8582e611100557365727300640009000400efbe874f7748da58069a2e000000c70500000000010000000000000000003a0000000000f7c54b0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000a8586c66100041646d696e003c0009000400efbea8582e61da58069a2e00000073e10100000001000000000000000000000000000000fa462b00410064006d0069006e00000014000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000da58069a100054656d7000003a0009000400efbea8582e61da58069a2e00000092e101000000010000000000000000000000000000007f832901540065006d007000000014000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0 = 5000310000000000da58069a1000737065616b003c0009000400efbeda58069ada58069a2e00000021340200000007000000000000000000000000000000d920cf0073007000650061006b00000014000000 OpenFileBox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0\NodeSlot = "1" OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 OpenFileBox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000a858536310004c6f63616c003c0009000400efbea8582e61da58069a2e00000091e101000000010000000000000000000000000000005c7c6d004c006f00630061006c00000014000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5000310000000000da58069a1000416b756d61003c0009000400efbeda58069ada58069a2e000000f8330200000007000000000000000000000000000000023e280141006b0075006d006100000014000000 OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0 OpenFileBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff OpenFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff OpenFileBox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4996 OpenFileBox.exe