Overview
overview
7Static
static
3Saphire 2020.zip
windows7-x64
1Saphire 2020.zip
windows10-2004-x64
1Saphire 20...me.txt
windows7-x64
1Saphire 20...me.txt
windows10-2004-x64
1Saphire 20...20.exe
windows7-x64
7Saphire 20...20.exe
windows10-2004-x64
7Saphire 20...ol.exe
windows7-x64
1Saphire 20...ol.exe
windows10-2004-x64
3Saphire 20...ae.dll
windows7-x64
1Saphire 20...ae.dll
windows10-2004-x64
1Saphire 20...vr.lic
windows7-x64
3Saphire 20...vr.lic
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
Saphire 2020.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Saphire 2020.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Saphire 2020/Read me.txt
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Saphire 2020/Read me.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Saphire 2020/sapphire-ae-install-2020.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Saphire 2020/sapphire-ae-install-2020.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Saphire 2020/step2/bfx-license-tool/bfx-license-tool.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Saphire 2020/step2/bfx-license-tool/bfx-license-tool.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Saphire 2020/step2/lib64/sapphire_ae.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Saphire 2020/step2/lib64/sapphire_ae.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Saphire 2020/step3/GenArts/rlm/vr.lic
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Saphire 2020/step3/GenArts/rlm/vr.lic
Resource
win10v2004-20241007-en
General
-
Target
Saphire 2020/step3/GenArts/rlm/vr.lic
-
Size
2KB
-
MD5
e4176512a4037ad69f0f7e23ccf34199
-
SHA1
7332e81769b90c03046f71d1da9b578f31515eca
-
SHA256
e4c7c3bc0d01f28679e3fb97d251df2e2e67e182c9ba9af57412ca673a0e5102
-
SHA512
3bfc9ad98dcd79317e528c46ea4df19e4b2418b857757e762dab10ac68ef51a6bd05d7eedec61359226af36f8adbce4671759db371ce16a167b19770dc2b1c25
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4284 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic"1⤵
- Modifies registry class
PID:772
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4284