e20f6cc5622d0ff337a2f87fb5b3f2b7b7aedc4cdd07018c27b38f4cb75b0db8

Analysis

max time kernel
2s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dionysus-2.0.10.tar.gz
Size

1.7MB
MD5

701c109d207cfdc42bc371a31c6503d7
SHA1

7f4f9c618da748b170e14eb9c0a47cc66592fe10
SHA256

e20f6cc5622d0ff337a2f87fb5b3f2b7b7aedc4cdd07018c27b38f4cb75b0db8
SHA512

2ffcb6da83d585e7b1df43b63bc193060b15ad0312534dfb38e4e7dbafac930ec2a365bd0b0c9c904797eeddd2e0258e5ae64961456b59000f2955001674e002
SSDEEP

24576:7DYTIzghIGUxKgXRTZy98NzXsGGL+f1I4vIX9MHM8YJ6J372/YAtbF:H9zgJgfRtQ8NzXs43lT372NtbF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2768	7zFM.exe
Token: 35	2768	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2768	3048	cmd.exe	16
PID 3048 wrote to memory of 2768	3048	cmd.exe	16
PID 3048 wrote to memory of 2768	3048	cmd.exe	16

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dionysus-2.0.10.tar.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\dionysus-2.0.10.tar.gz"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...