Overview
overview
7Static
static
3BorisFX Sa...re.dll
windows7-x64
1BorisFX Sa...re.dll
windows10-2004-x64
1BorisFX Sa...up.exe
windows7-x64
7BorisFX Sa...up.exe
windows10-2004-x64
7BorisFX Sa...64.lnk
windows7-x64
3BorisFX Sa...64.lnk
windows10-2004-x64
3BorisFX Sa...64.lnk
windows7-x64
3BorisFX Sa...64.lnk
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 23:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BorisFX Sapphire OFX/File/Sapphire.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
BorisFX Sapphire OFX/File/Sapphire.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
BorisFX Sapphire OFX/Setup.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
BorisFX Sapphire OFX/Setup.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
BorisFX Sapphire OFX/Win64.lnk
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
BorisFX Sapphire OFX/Win64.lnk
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
BorisFX Sapphire OFX/lib64.lnk
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
BorisFX Sapphire OFX/lib64.lnk
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
BorisFX Sapphire OFX/Win64.lnk
-
Size
1KB
-
MD5
34ddc4346b7a535ccd3c6c1ecb8bfa1e
-
SHA1
d4c55048a801642197a6b21193bf2d730d1918ff
-
SHA256
f9e7984280a67b1516d0f30de652c5efa129e9b23123bc5c529d4dfb5a106372
-
SHA512
f90f0930a80033f65281418446badc2f5399de4cae0b4a68ee4457464440ac39cfcb91e4960fbe6b6cd44de09d8871ece351b0e5babba663be6df238617db589
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5600310000000000c8528a141000506c7567696e7300400009000400efbebd52aa21ca5236332e000000a74a01000000030000000000000000000000000000003a4d250050006c007500670069006e007300000016000000 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1" cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 7400310000000000c35241ba10005341505048497e312e42554e0000580009000400efbec35241baca5236332e00000019be020000000600000000000000000000000000000089c8ea00530061007000700068006900720065002e006f00660078002e00620075006e0064006c00650000001c000000 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000ca52a101110050524f4752417e310000740009000400efbe874fdb49ca52d22d2e0000003c0000000000010000000000000000004a00000000007faca900500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 6200310000000000c252ab0d1000434f4d4d4f4e7e3100004a0009000400efbe874fdb49ca52b0322e0000003d000000000001000000000000000000000000000000958e1d0043006f006d006d006f006e002000460069006c0065007300000018000000 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = 5000310000000000c35214bc100057696e3634003c0009000400efbec35244baca5298212e00000087bf0200000004000000000000000000000000000000dc4c7300570069006e0036003400000014000000 cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5a00310000000000c35212bc1000436f6e74656e74730000420009000400efbec35241baca5236332e0000001abe0200000006000000000000000000000000000000df98000143006f006e00740065006e0074007300000018000000 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4a00310000000000bd52aa2110004f465800380009000400efbebd52aa21ca52b3322e000000a64a01000000050000000000000000000000000000008f621e004f0046005800000012000000 cmd.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 cmd.exe