a1d62ca161ebaf830b6d7446e82d738fd25d4016e843a1389217d69bcd236546

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bcd9cf9d5139863527d47809ccb575e.rar
Size

2.6MB
MD5

8bcd9cf9d5139863527d47809ccb575e
SHA1

d6656d22bfd358325b4176320e45d37082a606a6
SHA256

a1d62ca161ebaf830b6d7446e82d738fd25d4016e843a1389217d69bcd236546
SHA512

6b023f9374c8bd477dd032518d88e8cbeabff36c73d254e3423b640161835985dd8e35f1240d51835ab3b6f9dd339f0470745b1db6c4197b0de0fcbcb25b1460
SSDEEP

49152:gdETtwrpt4MfDpqVMXQ+dTm1InY0v9+jOZ56DN/cQIbVHP8Mdntb5xqGXIu:lM5tqVCTYjOZADBcPXPgs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1140	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1140	7zFM.exe
Token: 35	1140	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1140	2380	cmd.exe	29
PID 2380 wrote to memory of 1140	2380	cmd.exe	29
PID 2380 wrote to memory of 1140	2380	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8bcd9cf9d5139863527d47809ccb575e.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\8bcd9cf9d5139863527d47809ccb575e.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads