f8a2c7bf6611cc965e76f1286fc460ec47f3d7e4353877716417cd8b553b2667

Analysis

max time kernel
1162s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QuietForestGame.rar
Size

59.7MB
MD5

dade874401dd5c4eb32685563a1c1549
SHA1

b4f063159b9ea1f497b49daeff07247f9c216404
SHA256

f8a2c7bf6611cc965e76f1286fc460ec47f3d7e4353877716417cd8b553b2667
SHA512

e9a05df9e76795251ce23468db2b232c48b41ef51a59c8c0e3f7bbbb85f49e883c01d40e644531882dd2d8b80646ea1ff5fc6c5bfbbf08e09ed56bd51fa62b1e
SSDEEP

1572864:UhIvB5WCx+p8HfwX8uAsbjM/wEF4yM6ezCD:UhIvSCx+ewFiwEVezS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4396	7zFM.exe
Token: 35	4396	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4396	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4396	4944	cmd.exe	85
PID 4944 wrote to memory of 4396	4944	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\QuietForestGame.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\QuietForestGame.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads