Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 01:28
Behavioral task
behavioral1
Sample
Injected [Bind] App.7z
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Injected [Bind] App.7z
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Injected [Bind] App/Termux_0.118.0_Apkpure.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
Injected [Bind] App/Termux_0.118.0_Apkpure.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
Injected [Bind] App/ZArchiver_0.9.5.8.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
Injected [Bind] App.7z
-
Size
102.0MB
-
MD5
0c5902a62172840c6d0d6f59a7c72fce
-
SHA1
d9b320e2e9a1fbda7cebb9769142e67e6af48f70
-
SHA256
004a967ca1a3ff968b84ae932b31da62a7186a5dadb3e0662db799683cfe854a
-
SHA512
2046fcfd5d656d67472ae942eb8b72743834eade87c0bb9d15ab1794e966a59f3004b90fffc1fa4512dc6a0bef48e5cce8591d83e556233a7437cb13d37dd68d
-
SSDEEP
3145728:nlOHQlOZp0qWzewQk/iLWIDh04pfktWa9:lO/cp3/nIDmj
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7zFM.exedescription pid process Token: SeRestorePrivilege 2896 7zFM.exe Token: 35 2896 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7zFM.exepid process 2896 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2360 wrote to memory of 2896 2360 cmd.exe 7zFM.exe PID 2360 wrote to memory of 2896 2360 cmd.exe 7zFM.exe PID 2360 wrote to memory of 2896 2360 cmd.exe 7zFM.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Injected [Bind] App.7z"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Injected [Bind] App.7z"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow