ee70f30bd8e327e450bf960c2f4b3675cb4bf80d9f26c9a2cd0de2fc01ecb77b

Resubmissions

31-10-2024 00:44

241031-a3vrpatnfw 7

30-10-2024 19:18

241030-x1bx5azdng 10

Analysis

max time kernel
54s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rezux X V1.0.1.zip
Size

487KB
MD5

e4265881ea58c3075edfa61924702b6f
SHA1

841586bc50fa9cedaade2792e4dcad854306978f
SHA256

ee70f30bd8e327e450bf960c2f4b3675cb4bf80d9f26c9a2cd0de2fc01ecb77b
SHA512

1273a8966a51b77236c17afc7cc48abbb594963b2b5bdb89d718e22a93bb5a94de412c11d340991833db44cd23b48ca9f85e32140b900cdd267c8cbfead8f14d
SSDEEP

12288:asQ++++IN1j6H55wwwwwm2222z1t0gFjPlOACViUcEcdRvpgszRtrx:asDNutTjPlQchRBgsF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

Rezux X.exeRezux X.exeRezux X.exeRezux X.exe

pid	Process
3448	Rezux X.exe
4220	Rezux X.exe
4568	Rezux X.exe
2900	Rezux X.exe

Modifies registry class 2 IoCs

Processes:

7zFM.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
4524	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
3912	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	3912	7zFM.exe
Token: 35	3912	7zFM.exe
Token: SeSecurityPrivilege	3912	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid	Process
3912	7zFM.exe
3912	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Rezux X V1.0.1.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3912

C:\Users\Admin\Desktop\Rezux X.exe
"C:\Users\Admin\Desktop\Rezux X.exe"
1⤵
- Executes dropped EXE
PID:3448

C:\Users\Admin\Desktop\Rezux X.exe
"C:\Users\Admin\Desktop\Rezux X.exe"
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4680

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\password\RezuxX.security.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4524

C:\Users\Admin\Desktop\Rezux X.exe
"C:\Users\Admin\Desktop\Rezux X.exe"
1⤵
- Executes dropped EXE
PID:4568

C:\Users\Admin\Desktop\Rezux X.exe
"C:\Users\Admin\Desktop\Rezux X.exe"
1⤵
- Executes dropped EXE
PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Rezux X.exe

Filesize
463KB

MD5
dd6348580be74d093f9f92b81e4611e9

SHA1
e5d66547ca83fe4334d12f5de222da02669cfbfb

SHA256
16e95d2e510125f773ecce110772cce7b3626008ec12f58db532b12869c6aca3

SHA512
8a33f3e4671208ee839f1195db1e66530bb2ee19b4c1578897bdbef1d9cc8ce4dc22f13ff63ff362ef7c553f6be69ad2f8a03db63c522f96a1c752639bb089ea

Download Submit
C:\Users\Admin\Desktop\password\RezuxX.security.txt

Filesize
5.3MB

MD5
8cbf8aa928f2375dc1c4af6c997a1fe8

SHA1
c9b3c74b088354e8d766139f88dd8847f1b0be1a

SHA256
2f1cf8130a4196c2f702d2fbc9009f2aa2f3e7d269127876508d324f81865214

SHA512
b7c09b7b12f61798cb4f03bf7a6074942b8d1b2c1155021c8716255f306fe2ac4bc90b5f430b7ceed59a92904cc87c69539c44b39d03d066931ecd11781c9dfe

Download Submit