vobfus | 033570bf95d42dad2652ed0662a2369d954d4580d1b872ea44041697d0edc237

Resubmissions

01/10/2025, 17:19

251001-vwbqfstqz810

08/07/2025, 08:09

04/07/2025, 07:35

04/07/2025, 04:55

04/07/2025, 04:32

04/07/2025, 04:30

04/07/2025, 04:18

13/05/2024, 10:29

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2025, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WORM_VOBFUS.exe
Size 188KB
Sample250704-e483xsap8v
SHA256 7f7e5751277a0169ec2eb4492b0489ca850808f64b52e708f716f46ac160e54b
MD5 634aa845f5b0b519b6d8a8670b994906
SHA1 82ad537a7acb18702a02b6dd2c6d12eaac0b3656
SHA512 63a72331fed9c53d593d2b572fc35efe24eb9d5d292cbe891765926de60987fefa0ddc95aa9037384e45f52015ef075c4ce9aaf9bd297e4e437f606104257cbf
SSDEEP 3072:dzimFU1cIsisNUbaxF6qJDe94aqosAm+w90Z69:tisYGDe94aqosAm+w90C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vobfus defense_evasion discovery persistence worm

Malware Config

Signatures

Detects win.vobfus. 1 IoCs

Malware of this family searches for computers on a network and creates copies of itself in folders with open access. For the program to be activated, the user must first run it on the computer.

worm

resource	yara_rule
behavioral3/files/0x00080000000241dd-6.dat	win_vobfus_auto

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	caiubug.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WORM_VOBFUS.exe

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus
Vobfus family
vobfus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation	WORM_VOBFUS.exe

Executes dropped EXE 3 IoCs

pid	Process
2348	caiubug.exe
3252	caiubug.exe
3380	caiubug.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caiubug = "C:\\Users\\Admin\\caiubug.exe /d"	WORM_VOBFUS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caiubug = "C:\\Users\\Admin\\caiubug.exe /k"	caiubug.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4968	2348	WerFault.exe	85
2092	2348	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caiubug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caiubug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caiubug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORM_VOBFUS.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5964	WORM_VOBFUS.exe
5964	WORM_VOBFUS.exe
2348	caiubug.exe
2348	caiubug.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5964	WORM_VOBFUS.exe
2348	caiubug.exe
3252	caiubug.exe
3380	caiubug.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 2348	5964	WORM_VOBFUS.exe	85
PID 5964 wrote to memory of 2348	5964	WORM_VOBFUS.exe	85
PID 5964 wrote to memory of 2348	5964	WORM_VOBFUS.exe	85
PID 448 wrote to memory of 3252	448	cmd.exe	88
PID 448 wrote to memory of 3252	448	cmd.exe	88
PID 448 wrote to memory of 3252	448	cmd.exe	88
PID 3064 wrote to memory of 3380	3064	cmd.exe	93
PID 3064 wrote to memory of 3380	3064	cmd.exe	93
PID 3064 wrote to memory of 3380	3064	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe
"C:\Users\Admin\AppData\Local\Temp\WORM_VOBFUS.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Users\Admin\caiubug.exe
  "C:\Users\Admin\caiubug.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 696
    3⤵
    - Program crash
    PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 696
    3⤵
    - Program crash
    PID:2092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\caiubug.exe /d
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\caiubug.exe
  C:\Users\Admin\caiubug.exe /d
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\caiubug.exe /k
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\caiubug.exe
  C:\Users\Admin\caiubug.exe /k
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2348 -ip 2348
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2348 -ip 2348
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caiubug.exe

Path C:\Users\Admin\caiubug.exe
Size 188KB
SHA256 eb5309642f4f2eee9bab847c273fc95a623775148318fa90d78a9359e275e074
MD5 9f9cfcde9fd5e7ef3c4b88bd256f71d3
SHA1 f2c82a1111c1e1928bd6af19e8e09ec9bfb73e06
SHA512 468c292e487ae2a1c529b312914870da5df675e64fc8921b189eb59d5fb74bfcfe4db9886b8ef0603e3794b87a7d245bd03fbe466368027fa98b0a7ec09cf7ee
SSDEEP 3072:BzimFU1cI+5isNUbaxF6qJDe94aqosAm+w90Z69:p5isYGDe94aqosAm+w90C
MD5 SHA1 SHA512 SSDEEP

Submit Download