Overview

overview

10

Static

static

3

5a5d7f1763...0N.exe

windows7-x64

5a5d7f1763...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    15s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 19:57

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0N.exe

  • Size

    1.6MB

  • MD5

    6cd9d14f77f74c8ca86a6f13ad88c640

  • SHA1

    0ba25df509f6ee0c714348925fd22a31442772e0

  • SHA256

    5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0

  • SHA512

    f28323fb582efade2a9f13626dfda08c70ecca9bf0416d44aa3b93baa3a6adb2ffa56fe5e66334ae4465c1de86f9afe657f65caed9eba86cf6e1ca9917c9724e

  • SSDEEP

    49152:yfF/avsilbmSCvbprL6EPKcNHvGl9k8FGKu9:yarlqPvbpP6ENGlSCu9

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Signatures

  • Floxif family
    floxif
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0N.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2588
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2484
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:568

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Program Files\7-Zip\7-zip.dll
        Filesize

        99KB

        MD5

        956d826f03d88c0b5482002bb7a83412

        SHA1

        560658185c225d1bd274b6a18372fd7de5f336af

        SHA256

        f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

        SHA512

        6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

        Download Submit

      • \Program Files\7-Zip\7zFM.exe
        Filesize

        935KB

        MD5

        aa660881acf368692ec48e6274a477e4

        SHA1

        7c10676e4fc3fb8234b6db298bd5c6ee8c1a2040

        SHA256

        bdffad682db0cb0c11d36e850dd9e920097753e1bb1a6a6577c6316e410269c1

        SHA512

        ed31a5ea7ee02650e8b7b815442210cf4f2d431750e750cae88d39c4984f603422d4a52e276000afbb260259010b541488f91fe08b861d5fd074751e2ec66399

        Download Submit

      • \Program Files\Common Files\System\symsrv.dll
        Filesize

        67KB

        MD5

        7574cf2c64f35161ab1292e2f532aabf

        SHA1

        14ba3fa927a06224dfe587014299e834def4644f

        SHA256

        de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

        SHA512

        4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

        Download Submit

      • memory/568-241-0x0000000002B30000-0x0000000002B31000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2484-240-0x0000000002F10000-0x0000000002F11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2588-3-0x0000000010000000-0x0000000010030000-memory.dmp

        Filesize

        192KB

        Download

      • memory/2588-5-0x0000000000404000-0x0000000000407000-memory.dmp

        Filesize

        12KB

        Download

      • memory/2588-236-0x0000000010000000-0x0000000010030000-memory.dmp

        Filesize

        192KB

        Download

      • memory/2588-239-0x0000000010000000-0x0000000010030000-memory.dmp

        Filesize

        192KB

        Download