Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11-01-2024 14:06
General
-
Target
Yeezus.rar
-
Size
10.2MB
-
MD5
89244016652732d4e13623ccbcde05fe
-
SHA1
bec24f34223b41da38e6b5f1f9a57de6809c7bef
-
SHA256
7f62f4def03ffd80426a25d462e04497eda6a8848529a1d8d51e7936ce6c1131
-
SHA512
ce24a5c4734165758813c1ab07662745f8b00adc95aad755728d092099968343bb6dcf6137392732b52cc66bce004deda0a644fb361d1f606411d5d137699d1f
-
SSDEEP
196608:iVZ5QIEKtiNWVssmoZuSX/RZGmfe390Owlt51J7Vvfnx2Pwk7JGi83sYXjjW:guI1iNEhmLJGOkt57Vx2Pwk7wiFWa
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Yeezus.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Yeezus.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-