033570bf95d42dad2652ed0662a2369d954d4580d1b872ea44041697d0edc237

Resubmissions

01/10/2025, 17:19

251001-vwbqfstqz810

08/07/2025, 08:09

04/07/2025, 07:35

04/07/2025, 04:55

04/07/2025, 04:32

04/07/2025, 04:30

04/07/2025, 04:18

13/05/2024, 10:29

Analysis

max time kernel
103s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2025, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WORM_VOBFUS.exe
Size 212KB
Sample250704-e483xsap8v
SHA256 e54bbabcaed8ace734f53234a44ad1e697e9cd2252255b59906fc5e3322c1be6
MD5 7b19b2b8aed0285eb2b2c5cb81313569
SHA1 e0a536ed1b6c6f202412079e1213305543b533a3
SHA512 31f79937bb4aba8aecd95daf310c9dd22f06f4f842f4bae64502e27e44aa3ef26f25d8d72adae36f25aa4db6f7b229926dc8bda4d09613f7d1f6968a15cc2eb0
SSDEEP 3072:/lh+mENvtRR3FmHmpF+CklMnQIKAWNBlm/XBq6ciFCdaNdVOvs:9h+NNFRRCmpF+CklMYuFciFC+Ok
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WORM_VOBFUS.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	povap.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	WORM_VOBFUS.exe

Executes dropped EXE 4 IoCs

pid	Process
4964	povap.exe
3688	povap.exe
1700	povap.exe
5052	povap.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\povap = "C:\\Users\\Admin\\povap.exe /t"	povap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\povap = "C:\\Users\\Admin\\povap.exe /d"	povap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\povap = "C:\\Users\\Admin\\povap.exe /a"	WORM_VOBFUS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1444	3144	WerFault.exe	87
992	4964	WerFault.exe	95
1696	4964	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORM_VOBFUS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	povap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	povap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	povap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	povap.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3144	WORM_VOBFUS.exe
3144	WORM_VOBFUS.exe
4964	povap.exe
4964	povap.exe
4964	povap.exe
4964	povap.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3144	WORM_VOBFUS.exe
4964	povap.exe
3688	povap.exe
1700	povap.exe
5052	povap.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4964	3144	WORM_VOBFUS.exe	95
PID 3144 wrote to memory of 4964	3144	WORM_VOBFUS.exe	95
PID 3144 wrote to memory of 4964	3144	WORM_VOBFUS.exe	95
PID 4764 wrote to memory of 3688	4764	cmd.exe	99
PID 4764 wrote to memory of 3688	4764	cmd.exe	99
PID 4764 wrote to memory of 3688	4764	cmd.exe	99
PID 5512 wrote to memory of 1700	5512	cmd.exe	104
PID 5512 wrote to memory of 1700	5512	cmd.exe	104
PID 5512 wrote to memory of 1700	5512	cmd.exe	104
PID 2680 wrote to memory of 5052	2680	cmd.exe	112
PID 2680 wrote to memory of 5052	2680	cmd.exe	112
PID 2680 wrote to memory of 5052	2680	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe
"C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\povap.exe
  "C:\Users\Admin\povap.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 704
    3⤵
    - Program crash
    PID:992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 724
    3⤵
    - Program crash
    PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 1448
  2⤵
  - Program crash
  PID:1444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\povap.exe /a
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\povap.exe
  C:\Users\Admin\povap.exe /a
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\povap.exe /t
1⤵
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Users\Admin\povap.exe
  C:\Users\Admin\povap.exe /t
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 212 -p 3144 -ip 3144
1⤵
PID:1328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\povap.exe /d
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\povap.exe
  C:\Users\Admin\povap.exe /d
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4964 -ip 4964
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4964 -ip 4964
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

povap.exe

Path C:\Users\Admin\povap.exe
Size 212KB
SHA256 3c8e718bf741daa0f56a6e5029f89b9c3d1c7b7b5a5b8dd98508a0539d5e41dd
MD5 d640b1f7b047a3131ed510919453afea
SHA1 acd06775913c3c2eff03cde4e50a6aa1102b4d3b
SHA512 8798ed7e606120fa2a4b3da4552e57b3ff33dd312fc834e6586b804de23a4c0dbf7228211b6a2e3deaf87f8fda85c054ac5e1b7f155f4153f351d0c2a52c027c
SSDEEP 3072:RlUvmENvtRR3FmHmpF+CklMnQIKAWNBlm/XBq6ciFCdaNdVOvs:vUvNNFRRCmpF+CklMYuFciFC+Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download