Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/01/2025, 00:58
General
-
Target
0c7327804fe50c5c29fa43b70458201b99f22d3dd759f3f21b1b1edcb08c3566N.exe
-
Size
4.0MB
-
MD5
4a790c625fdacd05222a4e9cda95d030
-
SHA1
b13861ad929271e2987f8006ae4f4e7ed33dc7eb
-
SHA256
0c7327804fe50c5c29fa43b70458201b99f22d3dd759f3f21b1b1edcb08c3566
-
SHA512
604946a5baf29f7a6434c063426b72b66c36dea50c1ffe86f5775407217f42f25a388de33b8b64e11fa596121006366744d790c92674340779323db8ff16d0b8
-
SSDEEP
98304:dNRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAT:zR/gmeOqv7Ac9F0kl
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7327804fe50c5c29fa43b70458201b99f22d3dd759f3f21b1b1edcb08c3566N.exe"C:\Users\Admin\AppData\Local\Temp\0c7327804fe50c5c29fa43b70458201b99f22d3dd759f3f21b1b1edcb08c3566N.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\0c7327804fe50c5c29fa43b70458201b99f22d3dd759f3f21b1b1edcb08c3566n.exec:\users\admin\appdata\local\temp\0c7327804fe50c5c29fa43b70458201b99f22d3dd759f3f21b1b1edcb08c3566n.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
3.8MB
MD546c17c999744470b689331f41eab7df1
SHA1b8a63127df6a87d333061c622220d6d70ed80f7c
SHA256c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
SHA5124b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
-
Filesize
135KB
MD5daf1242b600ae3a9e1ceb1b315354e4f
SHA1ce303563d30ad0507bd0d11705b431d908ca9a7e
SHA2563e5f802384d53aec8d691cd8d42cc806a333f59bbd5987214de046e49c046d4f
SHA512ae96f00856cc821430fd061209c91f6e804c9078756d7b17e82e1513671306f8e19448bd2059e0db75fd95b213fccec593d6292b292a8d7804c07e4afd2d0410
-
Filesize
135KB
MD5d631c1db6efed795e55e4951da330a4a
SHA185d14105b74267c4de5b2ff1c19066f5004e666b
SHA256c7c3d4578fbb997bad608e16b06da403fd1aa4ebc2919a7767116fded8526bb2
SHA51205518df5e42377fa07e1808425292c50524e4a29afbe8392d463e602a4cf1414ad0c9113eac1ac5c81a82c214c7581799e3c2ce8db6a0d223ea688903e7b29ee
-
Filesize
135KB
MD50555b3e34d720f3cf5fb78d937dd746c
SHA1963570fcf2a49e031698bafadb3185f2beb4690e
SHA2560c23512e377227d8ba56c5bcecd6cf38490b754db22c2983b368286156712e94
SHA5127ae6ecdc26e6481e9cc5c14c2a6f0f96e25d2897dc91af837d408dbd5bf53934380734836139568382674c9b3141e8f6f2cd51851d66d50eabd6881d7a653102
-
Filesize
135KB
MD521a7e7fa1ecc4aedc76c646e95a27fce
SHA16b38d962d3e5349baaa8e2a44f2ade307b3ed863
SHA2566ff7d84952ff0ef57c661bae9b3519c2b4ee03e31b82f45f87dded3be9afd45d
SHA51244a083aa3abbe50322473afa49bcf25e1c99cf37d45f78a7e18b7582d8660e4268077f94a03a31b5c64ff2129d809e923c9d9366568b1b378576220bc912c64e
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
16KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB