Analysis

  • max time kernel
    104s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/06/2024, 19:15

General

  • Target

    Akuma/lib/speak/curl/SaveFileBox.exe

  • Size

    13KB

  • MD5

    8108ff69b5760c8117563d6b10f77158

  • SHA1

    f2f855408f671e1856f08d5f2b9bc74fa7e7bd0f

  • SHA256

    48eb5c03141732b810570b557fe148e3f76764df3a632008972de44be88497e3

  • SHA512

    63f1ab3095bf3a542bf980a43ea02948de9d1d44d975574aa7b6db20eb8e0fadd22c781a53c0e0603e81934bc3c96477c5330a2369728e5ea183f84712204ab9

  • SSDEEP

    192:AnIIycajz2wF6HrwFNjOCuMN55ZBZD8KKYPWOztfMj8:4/yfz2wFv+K5Zf99S

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 47 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\curl\SaveFileBox.exe
    "C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\curl\SaveFileBox.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4176-0-0x00007FF93A803000-0x00007FF93A805000-memory.dmp

    Filesize

    8KB

  • memory/4176-1-0x0000000000640000-0x000000000064A000-memory.dmp

    Filesize

    40KB

  • memory/4176-2-0x00007FF93A800000-0x00007FF93B2C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4176-3-0x00007FF93A803000-0x00007FF93A805000-memory.dmp

    Filesize

    8KB

  • memory/4176-4-0x00007FF93A800000-0x00007FF93B2C1000-memory.dmp

    Filesize

    10.8MB