Resubmissions
03/03/2025, 13:50
250303-q5agjay1c1 10Analysis
-
max time kernel
66s -
max time network
64s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03/03/2025, 13:50
Static task
static1
General
-
Target
Floxif.exe
-
Size
532KB
-
MD5
00add4a97311b2b8b6264674335caab6
-
SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec
-
SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f
-
SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70
-
SSDEEP
12288:l86GkvJFajbhjTpHjq0dfpT1Oc02XEfGdnGwVUNUnEnAE3F:l8lT9PdpwO0fkGwVUSnEnAoF
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000d000000027d67-1.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d000000027d67-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1632 Floxif.exe -
resource yara_rule behavioral1/files/0x000d000000027d67-1.dat upx behavioral1/memory/1632-4-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1632-8-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll Floxif.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1164 1632 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Floxif.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3276 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1632 Floxif.exe Token: SeDebugPrivilege 3276 taskmgr.exe Token: SeSystemProfilePrivilege 3276 taskmgr.exe Token: SeCreateGlobalPrivilege 3276 taskmgr.exe Token: SeSecurityPrivilege 3276 taskmgr.exe Token: SeTakeOwnershipPrivilege 3276 taskmgr.exe Token: 33 3276 taskmgr.exe Token: SeIncBasePriorityPrivilege 3276 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe 3276 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Floxif.exe"C:\Users\Admin\AppData\Local\Temp\Floxif.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 4842⤵
- Program crash
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1632 -ip 16321⤵PID:3604
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5ccf7e487353602c57e2e743d047aca36
SHA199f66919152d67a882685a41b7130af5f7703888
SHA256eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914
SHA512dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c