Analysis
- max time kernel
598s - max time network
486s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/05/2026, 00:59
General
- Target rufus-4.13.exe
- Size 1.9MB
- Sample260516-bb2xcshx2v
- SHA256 a314db019d608e3d9b2eda797ba5bbe4dfc91bcd621decd144a580080eb13b1b
Malware Config
Signatures
- Drops file in System32 directory 4 IoCs
- UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 28 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-4.13.exe"C:\Users\Admin\AppData\Local\Temp\rufus-4.13.exe"1⤵
- Drops file in System32 directory
- Checks whether UAC is enabled
- Checks SCSI registry key(s)
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
memory/1648-31-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-13-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-20-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-23-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-30-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-0-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-35-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-51-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-55-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-56-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-58-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-59-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-61-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-62-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-15-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-67-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-64-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-68-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-73-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-65-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-76-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-12-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-83-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-84-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-11-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-91-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-92-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-98-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp
memory/1648-99-0x00007FF74DAE0000-0x00007FF74E058000-memory.dmp