83e05ade36cb9ae64ed3cb37368c5c55eeedc19e592d82e2d1eb3a27d8025611

Resubmissions

23/02/2024, 01:02

240223-bea8tahb5v 3

23/02/2024, 00:57

240223-bbertsha9s 10

Analysis

max time kernel
314s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23/02/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Laucher_PC_S0FTv2O24.rar
Size

117.3MB
MD5

885dddbf0b81bdbe76c10acaf1f9238c
SHA1

a078b8d68203da038426a69ffa76423344617b7f
SHA256

83e05ade36cb9ae64ed3cb37368c5c55eeedc19e592d82e2d1eb3a27d8025611
SHA512

99cc83611764030635160566340af1eba07cd63fce1eb3585be17ea5d5a01e82e2a959162d954b6f962a31240da330f948b9835d0682de7bfca533bf1bf54c7b
SSDEEP

3145728:AwQRXAbwUfqGhYmG5STbiXKbvWt63N+vx2fHzVy3qAo:AwQRwMUCGqWTQ63Rpy3I

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2024	7zFM.exe
Token: 35	2024	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2024	1696	cmd.exe	74
PID 1696 wrote to memory of 2024	1696	cmd.exe	74

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Laucher_PC_S0FTv2O24.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Laucher_PC_S0FTv2O24.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...