c841a0c166bdd4518233a01e9a389af40fa80c972b27e471b2b70bc5c1c817cc

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 14:43

Target

file_v2_0.rar
Size

12.7MB
MD5

ef865d4214cbe1f0017c03b9c8b8a080
SHA1

92e91daa32b2bf34bb9a5b8d6de610f241568cf8
SHA256

c841a0c166bdd4518233a01e9a389af40fa80c972b27e471b2b70bc5c1c817cc
SHA512

d1a8637b115be27819ddcc1e6119ccd77d21e3904a3bad84cad82b2d1e3cf2e51deee21b9b931c9c027e2281a5b945239256a85f6407781a4b1cb4f81b99bdc7
SSDEEP

393216:889KAmRYZ1GT8s0fQN0bBrBqF759lKb7s3:xcAmou8sOq0bVIF7DY3A

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2680	7zFM.exe
Token: 35	2680	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2680	2460	cmd.exe	28
PID 2460 wrote to memory of 2680	2460	cmd.exe	28
PID 2460 wrote to memory of 2680	2460	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\file_v2_0.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\file_v2_0.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2680

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact