vobfus | 6ac6515ecb4eddfaef778983fef7d650d63828ef7763da3a51bbb48c51c5632b

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
Size

204KB
MD5

9da31c799423c6fdc3c45a753b03577d
SHA1

a6d1084fe6e6f81a07a54716d7674e061c9948db
SHA256

92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e
SHA512

54b39f0619d1c8265c520f8587c12d99a65b34fd936b939d54d7a6a250051e3ffd90ab075aed7e2b14fc6fa9f7ef12ecb41b8ee5ab255d655800c4ada703f666
SSDEEP

3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1

Score

10^/10

vobfus discovery persistence worm

Malware Config

Signatures

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3280	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3280	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
3280	92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe

C:\Users\Admin\AppData\Local\Temp\92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe
"C:\Users\Admin\AppData\Local\Temp\92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AG58FPQON.exe

Filesize
204KB

MD5
dd08820c9b21861e5c98d82f32c62e08

SHA1
ef218b4262263b1f267c32241a4e004dd21c5d06

SHA256
ec4924f2493adf8ec676dbb8674f978d5cf7ca93ad976f68e1e5108e6bb332b1

SHA512
d876f29a0014aec704a5b03d1aae47bd64140608ac11947af3ad2d8ea37629b3eebfa1ec56e03994b2c835b0c085cee317b71d9330314987d3ed60e6e1633197

Download Submit
memory/3280-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads