873c62547f6ad78c997c7f530e84e175e353b3b6c18e174b86a133fb7c3f3078

Resubmissions

03/02/2024, 20:19

240203-y3vcxsbgbq 1

03/02/2024, 20:17

240203-y2ynyshdc3 3

03/02/2024, 20:15

240203-y1xehahda4 7

03/02/2024, 20:11

240203-yydjlshcd7 3

Analysis

max time kernel
30s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
03/02/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_Getintopc.com_CCleaner_v5.84.9126.rar
Size

24.3MB
MD5

d0b8a0819707bd088895da48d80d4329
SHA1

821eb2b890bc2890391167064cc42a560df29171
SHA256

873c62547f6ad78c997c7f530e84e175e353b3b6c18e174b86a133fb7c3f3078
SHA512

f54a9e22755b2abf501e8f4e467de3e8bf19de69657b34e9cf971a8956de2645b8a106c173416fc7752579a4857507a57aa90b5980d952730c037cc2b3e4ed2f
SSDEEP

393216:OfFwQDN5YRwbq65Jz+vdi3CwiirIQXbiGXE8SqOkUlc3Ys20nS27jOCxrC:EDDYfSV+vKCwii68SjkmwYbEjQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4160	7zFM.exe
Token: 35	4160	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4160	1756	cmd.exe	80
PID 1756 wrote to memory of 4160	1756	cmd.exe	80

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_Getintopc.com_CCleaner_v5.84.9126.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\_Getintopc.com_CCleaner_v5.84.9126.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...