13607684da4fc4c2493996ff4ffe2347a806cb13b905d97bec815d5bf33824da

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.tar
Size

9.2MB
MD5

1c0e4eed997020aa05e6b2c107a169ae
SHA1

aaaec2f2e3dcbb7cd00bcc197d6e432dde4ae88e
SHA256

9aec808e1209de34afa1659dcfcd5cd218076f53dee7959388a377ab0625ef06
SHA512

ac18e8976fb583292386841c3cc313e11436fba810ca16b69524949f37a1e3df05093ffb9592ad07638b39e9f94941b5f9cca49828d7d09ca3ec7e194e860774
SSDEEP

196608:mYK2IZ79KzcDPdUGZuhXDYK2IZ79KzcDPdUGZuhX:mYX6kStyzYX6kSty

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2792	7zFM.exe
Token: 35	2792	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2792	2988	cmd.exe	29
PID 2988 wrote to memory of 2792	2988	cmd.exe	29
PID 2988 wrote to memory of 2792	2988	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...