Analysis
-
max time kernel
91s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20/12/2023, 05:19
General
-
Target
sample.tar
-
Size
9.2MB
-
MD5
1c0e4eed997020aa05e6b2c107a169ae
-
SHA1
aaaec2f2e3dcbb7cd00bcc197d6e432dde4ae88e
-
SHA256
9aec808e1209de34afa1659dcfcd5cd218076f53dee7959388a377ab0625ef06
-
SHA512
ac18e8976fb583292386841c3cc313e11436fba810ca16b69524949f37a1e3df05093ffb9592ad07638b39e9f94941b5f9cca49828d7d09ca3ec7e194e860774
-
SSDEEP
196608:mYK2IZ79KzcDPdUGZuhXDYK2IZ79KzcDPdUGZuhX:mYX6kStyzYX6kSty
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-