35f671ea54afd102bbd3df46a352d23df13db5b414289b02d5bbc1218fc6d9e4

Resubmissions

22-02-2024 19:03

240222-xqpfgaed92 10

22-02-2024 18:10

240222-wsetdade6t 10

Analysis

max time kernel
2s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22-02-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

71.9MB
MD5

d7d8d889fcb11df4a6d197af004e6ec5
SHA1

7daa428bc66320fa4015a4b40976b7731539a58c
SHA256

a7cf5898e658fa78610d409d3c52b82a1c9e289904bd70d4a8a045ab4808764e
SHA512

0fa93cf4c52696b7f235b850c05aded8dca728a413f8b024addd75e7bcacdeb75ddf5f5d6784ba5492dc1b1276a47fb537fc1659a87f3938bd8569cb086c5530
SSDEEP

1572864:OejOS3uvjpTF5/zgtW9o3ZuXgGUTMwRQVRxtylCO1Hsh+kpvpa:O9r1F580e3EX1eMjVRm91Hi3p0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	236	7zFM.exe
Token: 35	236	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
236	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 236	3584	cmd.exe	81
PID 3584 wrote to memory of 236	3584	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads