Analysis
- max time kernel
599s - max time network
583s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 00:59
General
- Target rufus-4.13.exe
- Size 1.9MB
- Sample260516-bb2xcshx2v
- SHA256 a314db019d608e3d9b2eda797ba5bbe4dfc91bcd621decd144a580080eb13b1b
Malware Config
Signatures
- Drops file in System32 directory 4 IoCs
- UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 29 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-4.13.exe"C:\Users\Admin\AppData\Local\Temp\rufus-4.13.exe"1⤵
- Drops file in System32 directory
- Checks whether UAC is enabled
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3784-0-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-11-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-12-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-13-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-15-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-17-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-18-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-20-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-22-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-23-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-24-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-25-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-27-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-29-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-30-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-32-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-33-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-34-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-36-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-38-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-39-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-40-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-42-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-43-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-44-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-45-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-46-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-47-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-48-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-50-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-52-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-53-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-54-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-56-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-57-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-59-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-60-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-61-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-63-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-65-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-66-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-67-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-68-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-69-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-71-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-72-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-73-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-74-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-75-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-76-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-77-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-78-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-80-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-81-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-83-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-84-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-86-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-87-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-88-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-90-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-91-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp
memory/3784-93-0x00007FF6A1760000-0x00007FF6A1CD8000-memory.dmp