Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 14:30
Behavioral task
behavioral1
Sample
rufus-4.15p.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target rufus-4.15p.exe
- Size 1.9MB
- Sample260722-rvmvjsszhy
- SHA256 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
- MD5 9ec58202a786e33506e852dc9ddd03f7
- SHA1 f42ac0f91d72116e329d19cdb270187181e317db
- SHA512 6194cda6ade733ba097f45a1cff9d32392eabb9e44669abc18d81158d763e7a07bbda1c0392a7fd02fae412d74f3fd12dc6cbc36a19cc9c064787b9e3b3a14ef
- SSDEEP 49152:oWuJkGtsXh6x5hd8KDUBB8wI9CKjX1PUDfBd/:oWuQh6x5v8RBawI9CsX1MT
- TLSH T1029533B3CFE89525D9E714F2BF5C49539B91384FA5294B9B30E72E0CAC6434CA0A1E5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy rufus-4.15p.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rufus-4.15p.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rufus-4.15p.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rufus-4.15p.exe -
resource yara_rule behavioral1/memory/3092-0-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-39-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-38-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-40-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-42-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-44-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-51-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-58-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-63-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-98-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-99-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-101-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-102-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-104-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-105-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx behavioral1/memory/3092-107-0x00007FF6121F0000-0x00007FF6127A1000-memory.dmp upx - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rufus-4.15p.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 rufus-4.15p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters rufus-4.15p.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID rufus-4.15p.exe - Modifies registry class 28 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 rufus-4.15p.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rufus-4.15p.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rufus-4.15p.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000344a71fb19e3dc012ad2d0d226e3dc0108baf2c3e619dd0114000000 rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rufus-4.15p.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" rufus-4.15p.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" rufus-4.15p.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe Token: SeLoadDriverPrivilege 3092 rufus-4.15p.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3092 rufus-4.15p.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe 3092 rufus-4.15p.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rufus-4.15p.exe"C:\Users\Admin\AppData\Local\Temp\rufus-4.15p.exe"1⤵
- Drops file in System32 directory
- Checks whether UAC is enabled
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3092
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3060
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1716
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rufus.ini
- Size 41B
- SHA256 518bcf0a2793c77c1343d28ee88332f9d2c11c8565d11778bd5890e0bd505f68
- MD5 bffe0f55f3acbd43e4fe8ead2c9d1680
- SHA1 1086f954f3fba337024429da0b62943f7b63d44e
- SHA512 4cf347af073ad514b012b390448043fcc8f4661858524db7430c333033fe0c0e03c66ed033a30cc82838f1035d014dca6f5c8c4fe1dad5599560ecdaf91c6b7a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\rufus.ini
- Size 70B
- SHA256 24fcfca5caf126fb1b22105433dc5f214a66c8040b519166cbddc512842d08d1
- MD5 26ea240c95a3d8dce7a78cbb90fafcf2
- SHA1 e25d883c23f23d3071275bb7ba5efe4afc712577
- SHA512 a1fbb75fb9682a805bc2395509cd1e629c2ae3a3c1f797bd9cbd43a8410b750d37ab3495fe8092e49d31d68533edec4a0ad1e8aea902744b9a23ab1fe1d3e436
- TLSH T1D3A001059B07A62A76E965286C4448912995680A479A592282D6B841028FD47845A14A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rufus.ini
- Size 101B
- SHA256 48c314015b58ad4b764fa9cf55033f2686079bbbe84dbed8f82ece63b57a71ed
- MD5 bd4b0659a8e450c8873059796f1f7d43
- SHA1 fb50b32f59ba1d6bed214af264972e8357f336ec
- SHA512 7770f0d2394a5ff68bfcea8274f800d8e4f0874cbcc596a4cc262074978340022b0326e0db755026bf9191a4be499f66b7c1cb2d3847e4b4a954b81ea0481b93
- TLSH T1F5B01200AB27512972D5502C6C051D8128869F0B4786551345D3BC4003CFD13C07B109
- MD5 SHA1 SHA512 TLSH