Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 19:06
General
-
Target
fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
-
Size
271KB
-
MD5
104e8d1eeac87bdae748957c3a1c2170
-
SHA1
cf12406807753a8caff0dda2b855b216544a94d2
-
SHA256
fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918
-
SHA512
0768a926ce27add3bc75a356059e71504cc1c824eb86c7c93922c0765b0e7f6d9045c63b47dc61f27a23f79990b4b8e95bbfce7efcb00ee1e2043a11eb2d1375
-
SSDEEP
6144:XILqdufR6Da5zmR7BV+UdvrEFp7hKlCUx/:4B6Da5zGBjvrEH7e7/
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe"C:\Users\Admin\AppData\Local\Temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exec:\users\admin\appdata\local\temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
135KB
MD5a19aca0ed8ecc5887fc69c825de167a2
SHA14847693524dfb08b7ab6961324f6dea291b019cc
SHA25631f129cb7dcd1a4e2da103f6fb9a6d75184461337fedddcbae5d79d929087c5e
SHA5125a37a7a3b1b29553542c191ff087465b3ea514214339a1a88e4d93853c957c492c4ed488280cc952b725adcb9561bf041c8a0c21b073616b68fcb63d6f6aefc3
-
Filesize
135KB
MD51954f8dfe5c17a8d56fd5befee052c3a
SHA1c3af21ac64d775b9950f2229967d16ed0d6ef957
SHA256bb16f5b8140e4a947d8c51d4687a2e2d55ed8686d55b54e2608d1838d53a598d
SHA51243f5cf826888c535e05f19260ecda823491387024477d7f7087337764e65859cc6554bb92708f61d28746a09c616c0f21187ba8214e7c2b536552b9b21cf0a9a
-
Filesize
135KB
MD5d0b7a4a1bb2587ba056854d830133472
SHA1c2cc005517bb4957804679a4ae00adbaaf119f14
SHA2560830b95e9747e5b201e60134a17b01cf4bd3188d582877a8504a6433f67c3516
SHA512b4ec8ffffb41a6936abb43dcc1a9c486d7f0f441bfccd2aeacb8cc69e331964aaf029d4735ac7b600366a3eb7edf55cbadcd46be37247c4196ccc62941358319
-
Filesize
135KB
MD57f1991beb549ceaecda6e82b69ee9379
SHA1028c42db4dba97e72d5c06f8e1ab7ebdbda10ed9
SHA25619a2d7f3dd677727e57acea50a1347bd3cef197bf82aabd182e0916273b5c2c7
SHA512530e9d12a7c5c42811bb5c188a4e2189c5f855a90d6529dd8d3ae05c178dd0a31ee77948c847be35fc24ba000575bf2b9c60bfd693e403db72fd493e9366337d
-
Filesize
59KB
MD52a0063bb4d8669ddc603064c36bb290b
SHA149aefdf9e9f9d7c2f2af35c7f46dac6dc349618f
SHA2565e84b6a41d3df263a83f67989f1401bd02cf9e13582d124cd44260e7ef9cac08
SHA5129e1bce5c1c85aa4850ff7cc956147eb1bf231d8142f39152fe1b94f98be97b4f8c4853e9f5523e8b6d1c0aef60e86b02121623ba0b88583905eb69f7b14a8393
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
124KB
-
Filesize
192KB
-
Filesize
192KB