Overview
overview
7Static
static
7Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/cmdbkg.exe
windows10-2004-x64
1Akuma/lib/cmdwiz.exe
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
1Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/...kg.exe
windows10-2004-x64
1Akuma/lib/...iz.exe
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
1Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
3Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
3Akuma/lib/...ox.exe
windows10-2004-x64
3Akuma/lib/...ox.exe
windows10-2004-x64
3Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/...kg.exe
windows10-2004-x64
1Akuma/lib/...iz.exe
windows10-2004-x64
1Akuma/lib/...rl.exe
windows10-2004-x64
1Akuma/lib/...rl.exe
windows10-2004-x64
1Akuma/lib/...td.exe
windows10-2004-x64
7Akuma/lib/...64.exe
windows10-2004-x64
7Akuma/lib/...86.exe
windows10-2004-x64
7Akuma/lib/...rl.exe
windows10-2004-x64
1Analysis
-
max time kernel
104s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 19:15
Behavioral task
behavioral1
Sample
Akuma/lib/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
Akuma/lib/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Akuma/lib/bookmarks_parser.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Akuma/lib/cmdbkg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Akuma/lib/cmdwiz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
Akuma/lib/speak/7za/x64/7za.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Akuma/lib/speak/7za/x64/7za.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
Akuma/lib/speak/7za/x64/7zxa.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Akuma/lib/speak/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
Akuma/lib/speak/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Akuma/lib/speak/bookmarks_parser.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Akuma/lib/speak/cmdbkg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Akuma/lib/speak/cmdwiz.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
Akuma/lib/speak/curl/7za/x64/7za.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Akuma/lib/speak/curl/7za/x64/7za.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
Akuma/lib/speak/curl/7za/x64/7zxa.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Akuma/lib/speak/curl/7za/x86/7za.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
Akuma/lib/speak/curl/7za/x86/7za.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Akuma/lib/speak/curl/7za/x86/7zxa.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
Akuma/lib/speak/curl/OpenFileBox.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Akuma/lib/speak/curl/SaveFileBox.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
Akuma/lib/speak/curl/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Akuma/lib/speak/curl/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
Akuma/lib/speak/curl/bookmarks_parser.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Akuma/lib/speak/curl/cmdbkg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
Akuma/lib/speak/curl/cmdwiz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Akuma/lib/speak/curl/curl/x64/curl.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
Akuma/lib/speak/curl/curl/x86/curl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Akuma/lib/speak/curl/speak/extd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Akuma/lib/speak/curl/speak/x64/speak-x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Akuma/lib/speak/curl/speak/x86/speak-x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
Akuma/lib/speak/curl/x64/curl.exe
Resource
win10v2004-20240611-en
General
-
Target
Akuma/lib/speak/curl/SaveFileBox.exe
-
Size
13KB
-
MD5
8108ff69b5760c8117563d6b10f77158
-
SHA1
f2f855408f671e1856f08d5f2b9bc74fa7e7bd0f
-
SHA256
48eb5c03141732b810570b557fe148e3f76764df3a632008972de44be88497e3
-
SHA512
63f1ab3095bf3a542bf980a43ea02948de9d1d44d975574aa7b6db20eb8e0fadd22c781a53c0e0603e81934bc3c96477c5330a2369728e5ea183f84712204ab9
-
SSDEEP
192:AnIIycajz2wF6HrwFNjOCuMN55ZBZD8KKYPWOztfMj8:4/yfz2wFv+K5Zf99S
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 47 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000cb58199f100041646d696e003c0009000400efbecb58ac94da58089a2e00000078e101000000010000000000000000000000000000003f0cfa00410064006d0069006e00000014000000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0 = 5000310000000000da58089a1000737065616b003c0009000400efbeda58089ada58089a2e000000a7350200000007000000000000000000000000000000d771b50073007000650061006b00000014000000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5000310000000000da58089a1000416b756d61003c0009000400efbeda58089ada58089a2e0000007e350200000007000000000000000000000000000000c98d230141006b0075006d006100000014000000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000cb58b49610004c6f63616c003c0009000400efbecb58ac94da58089a2e00000096e101000000010000000000000000000000000000003701a6004c006f00630061006c00000014000000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = 4a00310000000000da58089a10006c696200380009000400efbeda58089ada58089a2e000000833502000000070000000000000000000000000000000c1617016c0069006200000012000000 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell SaveFileBox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000cb58ac941100557365727300640009000400efbe874f7748da58089a2e000000c70500000000010000000000000000003a0000000000ec41130055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0 = 4e00310000000000da58089a10006375726c00003a0009000400efbeda58089ada58089a2e000000cb35020000000700000000000000000000000000000041f7de006300750072006c00000014000000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000da58089a100054656d7000003a0009000400efbecb58ac94da58089a2e00000097e1010000000100000000000000000000000000000054872501540065006d007000000014000000 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags SaveFileBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 SaveFileBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000cb58ac9412004170704461746100400009000400efbecb58ac94da58089a2e00000083e10100000001000000000000000000000000000000069002004100700070004400610074006100000016000000 SaveFileBox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 SaveFileBox.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\0\NodeSlot = "1" SaveFileBox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4176 SaveFileBox.exe