Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe
Resource
win7-20240903-en
Errors
General
-
Target
0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe
-
Size
4.3MB
-
MD5
ef8964650a9250cfa383c8dff1a5fa90
-
SHA1
522902d626a37e65810d16bc5e1d2d3b0adffb8d
-
SHA256
0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082c
-
SHA512
a15cbf510ca77821d5939e2f8d4f6039304eb517fdf6972dcd2ad91571fb5416dc6afd1243db36ab7e1d466d4818546c74cdf1f4a9fa6e444df784bc6ff6e1ab
-
SSDEEP
98304:v94tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6QF:vklhE9U6476itR+mLPw6lyZY6g
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b35-2.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000023b35-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 4452 install.exe -
Loads dropped DLL 3 IoCs
pid Process 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe 4452 install.exe 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\e: 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
resource yara_rule behavioral2/files/0x000c000000023b35-2.dat upx behavioral2/memory/208-5-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/208-65-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/208-67-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/208-99-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe File created \??\c:\program files\common files\system\symsrv.dll.000 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\ msiexec.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9EFF.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification \??\c:\Windows\Installer\ msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "46" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe 3504 msiexec.exe 3504 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe Token: SeShutdownPrivilege 4452 install.exe Token: SeIncreaseQuotaPrivilege 4452 install.exe Token: SeSecurityPrivilege 3504 msiexec.exe Token: SeCreateTokenPrivilege 4452 install.exe Token: SeAssignPrimaryTokenPrivilege 4452 install.exe Token: SeLockMemoryPrivilege 4452 install.exe Token: SeIncreaseQuotaPrivilege 4452 install.exe Token: SeMachineAccountPrivilege 4452 install.exe Token: SeTcbPrivilege 4452 install.exe Token: SeSecurityPrivilege 4452 install.exe Token: SeTakeOwnershipPrivilege 4452 install.exe Token: SeLoadDriverPrivilege 4452 install.exe Token: SeSystemProfilePrivilege 4452 install.exe Token: SeSystemtimePrivilege 4452 install.exe Token: SeProfSingleProcessPrivilege 4452 install.exe Token: SeIncBasePriorityPrivilege 4452 install.exe Token: SeCreatePagefilePrivilege 4452 install.exe Token: SeCreatePermanentPrivilege 4452 install.exe Token: SeBackupPrivilege 4452 install.exe Token: SeRestorePrivilege 4452 install.exe Token: SeShutdownPrivilege 4452 install.exe Token: SeDebugPrivilege 4452 install.exe Token: SeAuditPrivilege 4452 install.exe Token: SeSystemEnvironmentPrivilege 4452 install.exe Token: SeChangeNotifyPrivilege 4452 install.exe Token: SeRemoteShutdownPrivilege 4452 install.exe Token: SeUndockPrivilege 4452 install.exe Token: SeSyncAgentPrivilege 4452 install.exe Token: SeEnableDelegationPrivilege 4452 install.exe Token: SeManageVolumePrivilege 4452 install.exe Token: SeImpersonatePrivilege 4452 install.exe Token: SeCreateGlobalPrivilege 4452 install.exe Token: SeRestorePrivilege 3504 msiexec.exe Token: SeTakeOwnershipPrivilege 3504 msiexec.exe Token: SeShutdownPrivilege 4452 install.exe Token: SeRestorePrivilege 3504 msiexec.exe Token: SeTakeOwnershipPrivilege 3504 msiexec.exe Token: SeRestorePrivilege 3504 msiexec.exe Token: SeTakeOwnershipPrivilege 3504 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3980 LogonUI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 208 wrote to memory of 4452 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe 86 PID 208 wrote to memory of 4452 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe 86 PID 208 wrote to memory of 4452 208 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe"C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\6ab220b62523e330606df8\install.exec:\6ab220b62523e330606df8\.\install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39bb855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD54138c31964fbcb3b7418e086933324c3
SHA197cc6f58fb064ab6c4a2f02fb665fef77d30532f
SHA256b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
SHA51240cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557
-
Filesize
162KB
MD50117b86ae22a53cd03596b4e591d3e90
SHA1aca287513c9c8a0f535e1201a19123e78f98a307
SHA25607fc0ea97cd48c03ce2c8429a43e3a8592d847fe093d58087120667984a01348
SHA51278c3aa0e035308ca7de94749f878b4d6dc39a63d23397a1886d6dca4883fbb52e0693abebff986da0fe6705a4381486da4fa873f6bcf7239e8d917ae56bf8f15
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
1KB
MD52401203ed7472e91a6331a0763003bdf
SHA105eff2e849f201c12a119c98dc46a020aaf5ad8d
SHA2560fbbb8f4875c4e723051dd94b5eec0b3665bdaa53b75ae30958767aa3be3f3c9
SHA5128541b42bbd1c08fc6d2181914b35a7a4bbd2b5f4a35af7b9c2172c510228e92bbaeee3ab9803a6f110a813f85a58830d08a04291b69f5ce14866fddff1b0c2de
-
Filesize
1KB
MD50a6b586fabd072bd7382b5e24194eac7
SHA160e3c7215c1a40fbfb3016d52c2de44592f8ca95
SHA2567912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
SHA512b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
-
Filesize
841B
MD5f8f6c0e030cb622f065fe47d61da91d7
SHA1cf6fa99747de8f35c6aea52df234c9c57583baa3
SHA256c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
SHA512b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde
-
Filesize
85KB
MD5ff6003014eefc9c30abe20e3e1f5fbe8
SHA14a5bd05f94545f01efc10232385b8fecad300678
SHA256a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067
SHA5123adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2
-
Filesize
222KB
MD57e641e6a0b456271745c20c3bb8a18f9
SHA1ae6cedcb81dc443611a310140ae4671789dbbf3a
SHA25634c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
SHA512f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903
-
Filesize
5KB
MD506fba95313f26e300917c6cea4480890
SHA131beee44776f114078fc403e405eaa5936c4bc3b
SHA256594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
SHA5127dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd