5b3dc5017ab4178e6a056c61ef8e205982bcfa7b7fd8854b82fd4e9aa9d0274d

Resubmissions

22/01/2024, 21:07

240122-zydp2sdhd810

22/01/2024, 19:29

240122-x7dejadbb710

Analysis

max time kernel
442s
max time network
1165s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
22/01/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Craft_Rise_Hack_Cheat_V1.17.23.rar
Size 1.6MB
Sample240122-x7dejadbb7
SHA256 5b3dc5017ab4178e6a056c61ef8e205982bcfa7b7fd8854b82fd4e9aa9d0274d
MD5 93a2d291f97442a59b72fec4f2476e10
SHA1 1dfd92db8cff0ab3bcc890f5dd1e543db3964076
SHA512 9f837546b148f192ec8e0ac4daecc4e628642536aacb70e682f7676cd7488f114273ae5995d022a636712974f91087c8f672ee10eaa26debba01224986a5f191
SSDEEP 24576:vsf6bNAHs5p9R0bHgCibGt5CdPRpafJsTsO97qHmYbvrPsr2XWY1DKx:/bqH+pEs9KfvRgL9eGDamYS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1199853020-417986905-91977573-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2024	7zFM.exe
Token: 35	2024	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2024	2388	cmd.exe	79
PID 2388 wrote to memory of 2024	2388	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Craft_Rise_Hack_Cheat_V1.17.23.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Craft_Rise_Hack_Cheat_V1.17.23.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads