Overview
overview
7Static
static
3Saphire 2020.zip
windows7-x64
1Saphire 2020.zip
windows10-2004-x64
1Saphire 20...me.txt
windows7-x64
1Saphire 20...me.txt
windows10-2004-x64
1Saphire 20...20.exe
windows7-x64
7Saphire 20...20.exe
windows10-2004-x64
7Saphire 20...ol.exe
windows7-x64
1Saphire 20...ol.exe
windows10-2004-x64
3Saphire 20...ae.dll
windows7-x64
1Saphire 20...ae.dll
windows10-2004-x64
1Saphire 20...vr.lic
windows7-x64
3Saphire 20...vr.lic
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
Saphire 2020.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Saphire 2020.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Saphire 2020/Read me.txt
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Saphire 2020/Read me.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Saphire 2020/sapphire-ae-install-2020.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Saphire 2020/sapphire-ae-install-2020.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Saphire 2020/step2/bfx-license-tool/bfx-license-tool.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Saphire 2020/step2/bfx-license-tool/bfx-license-tool.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Saphire 2020/step2/lib64/sapphire_ae.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Saphire 2020/step2/lib64/sapphire_ae.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Saphire 2020/step3/GenArts/rlm/vr.lic
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Saphire 2020/step3/GenArts/rlm/vr.lic
Resource
win10v2004-20241007-en
General
-
Target
Saphire 2020/step3/GenArts/rlm/vr.lic
-
Size
2KB
-
MD5
e4176512a4037ad69f0f7e23ccf34199
-
SHA1
7332e81769b90c03046f71d1da9b578f31515eca
-
SHA256
e4c7c3bc0d01f28679e3fb97d251df2e2e67e182c9ba9af57412ca673a0e5102
-
SHA512
3bfc9ad98dcd79317e528c46ea4df19e4b2418b857757e762dab10ac68ef51a6bd05d7eedec61359226af36f8adbce4671759db371ce16a167b19770dc2b1c25
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2956 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2956 AcroRd32.exe 2956 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 996 wrote to memory of 2232 996 cmd.exe 32 PID 996 wrote to memory of 2232 996 cmd.exe 32 PID 996 wrote to memory of 2232 996 cmd.exe 32 PID 2232 wrote to memory of 2956 2232 rundll32.exe 33 PID 2232 wrote to memory of 2956 2232 rundll32.exe 33 PID 2232 wrote to memory of 2956 2232 rundll32.exe 33 PID 2232 wrote to memory of 2956 2232 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5824f4a496fe50b91cc9e69618347011c
SHA14b3645872b884f5fd98a5c2c8b1c07ef1cfb3cb5
SHA25604976e0d6a3e1a1a9aa39477ff62f151f03c568d7f47e9507810b38b4a2387a8
SHA51205c7d14c475f27bc2cde0835f26a8bdb5a5477be4b3499cd281d52d67163698765ea24190136c196ab2196580ede6499c016aa210fd8456f0958b35ee8925327