84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106

General

Target
rufus-4.15.exe
Size 1.9MB
Sample261024-ny2lbstygx
SHA256 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
MD5 9ec58202a786e33506e852dc9ddd03f7
SHA1 f42ac0f91d72116e329d19cdb270187181e317db
SHA512 6194cda6ade733ba097f45a1cff9d32392eabb9e44669abc18d81158d763e7a07bbda1c0392a7fd02fae412d74f3fd12dc6cbc36a19cc9c064787b9e3b3a14ef
SSDEEP 49152:oWuJkGtsXh6x5hd8KDUBB8wI9CKjX1PUDfBd/:oWuQh6x5v8RBawI9CsX1MT
TLSH
T1029533B3CFE89525D9E714F2BF5C49539B91384FA5294B9B30E72E0CAC6434CA0A1E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	rufus-4.15.exe
File opened for modification	C:\Windows\System32\GroupPolicy	rufus-4.15.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	rufus-4.15.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	rufus-4.15.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3080-0-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp	upx
behavioral1/memory/3080-37-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp	upx
behavioral1/memory/3080-41-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp	upx
behavioral1/memory/3080-45-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rufus-4.15.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rufus-4.15.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	rufus-4.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	rufus-4.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	rufus-4.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	rufus-4.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	rufus-4.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rufus-4.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	rufus-4.15.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe
Token: SeLoadDriverPrivilege	3080	rufus-4.15.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3080	rufus-4.15.exe

C:\Users\Admin\AppData\Local\Temp\rufus-4.15.exe
"C:\Users\Admin\AppData\Local\Temp\rufus-4.15.exe"
1⤵
- Drops file in System32 directory
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3080

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RufDCDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RufDCDE.tmp
Size 1.3MB
SHA256 ffeef3ab9f2369105021fdf3220f013f51e9f832fe3cf2598b096432e67e2d6c
MD5 381b2278e686293823a7586b63e63910
SHA1 25e4ccd9c2bbec04ebd72311edf3d18e5eda43d9
SHA512 e22c94379cbf3954a00f4075d0f7e378d2c9a37d0ebf5eaf131ed47ff15db8debec6d4725d146c83a8547602bf1c4d2ee6d3ddfa3dc0728c03e863587ffbf93f
SSDEEP 24576:1fBhT6BRPul9QWqOx/THVGVj2YRNdgSD/+Hi3t:1Zhvl9QWqwVGLP/Wa
TLSH
T18B554B2506D67518C1B3328A9C873A1A6ADB4D7BAF23E1C5B3DC472938F1217821BD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 14694dbee3897b6bd5aa596ebfd893e727179b67811920c174dc70e6eee8e579
MD5 f9a49a3e2415016fa85ddff0b8b38419
SHA1 f8c987119269e58d22a6b17ae2e8eca7744fb385
SHA512 91ea129a51d2c3b342287c1250f5b0da6ba2a61eff11791d1cfae1f5c6dd2654c935be1452f4a681e794fd723a3c295e9bc9e59b9005aa4d8bd55ed36c9ad91c
TLSH
T128B02B1303400026C02B034040A8150491AC0008F17040F9F313D24F9782A205C7A851
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3080-0-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp

Download

memory/3080-37-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp

Download

memory/3080-41-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp

Download

memory/3080-45-0x00007FF72FCE0000-0x00007FF730291000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads