Overview
overview
7Static
static
3Saphire 2020.zip
windows7-x64
1Saphire 2020.zip
windows10-2004-x64
7Saphire 20...me.txt
windows7-x64
1Saphire 20...me.txt
windows10-2004-x64
1Saphire 20...20.exe
windows7-x64
7Saphire 20...20.exe
windows10-2004-x64
7Saphire 20...ol.exe
windows7-x64
1Saphire 20...ol.exe
windows10-2004-x64
3Saphire 20...ae.dll
windows7-x64
1Saphire 20...ae.dll
windows10-2004-x64
1Saphire 20...vr.lic
windows7-x64
3Saphire 20...vr.lic
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
Saphire 2020.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Saphire 2020.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Saphire 2020/Read me.txt
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Saphire 2020/Read me.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Saphire 2020/sapphire-ae-install-2020.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Saphire 2020/sapphire-ae-install-2020.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Saphire 2020/step2/bfx-license-tool/bfx-license-tool.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Saphire 2020/step2/bfx-license-tool/bfx-license-tool.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Saphire 2020/step2/lib64/sapphire_ae.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Saphire 2020/step2/lib64/sapphire_ae.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Saphire 2020/step3/GenArts/rlm/vr.lic
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Saphire 2020/step3/GenArts/rlm/vr.lic
Resource
win10v2004-20241007-en
General
-
Target
Saphire 2020/step3/GenArts/rlm/vr.lic
-
Size
2KB
-
MD5
e4176512a4037ad69f0f7e23ccf34199
-
SHA1
7332e81769b90c03046f71d1da9b578f31515eca
-
SHA256
e4c7c3bc0d01f28679e3fb97d251df2e2e67e182c9ba9af57412ca673a0e5102
-
SHA512
3bfc9ad98dcd79317e528c46ea4df19e4b2418b857757e762dab10ac68ef51a6bd05d7eedec61359226af36f8adbce4671759db371ce16a167b19770dc2b1c25
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2756 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2756 AcroRd32.exe 2756 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2528 wrote to memory of 480 2528 cmd.exe 32 PID 2528 wrote to memory of 480 2528 cmd.exe 32 PID 2528 wrote to memory of 480 2528 cmd.exe 32 PID 480 wrote to memory of 2756 480 rundll32.exe 33 PID 480 wrote to memory of 2756 480 rundll32.exe 33 PID 480 wrote to memory of 2756 480 rundll32.exe 33 PID 480 wrote to memory of 2756 480 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Saphire 2020\step3\GenArts\rlm\vr.lic"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5077e2059975b15af8a092b78788fed83
SHA16b6d1f2632094f47df168a8480df88e9102c1ba4
SHA25640efd486b9e6c92a9f98091b5dab2cc8dac233949e3e17faa12e010af1ff45d6
SHA512df07c809ad2500ce932661daec95154eb20d53b5cd1be3cebf44bd327d1e84bbcce02dfb5de833a81366fc27f86dc4eeb3c48b8e1eb828ffe24196c39334ff2e