Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 19:16
Behavioral task
behavioral1
Sample
Aurora V3.1.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Aurora V3.1.rar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Aurora/Aurora.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Aurora/Aurora.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Aurora/scripts/scripts.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
Aurora/scripts/scripts.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
README.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
README.txt
Resource
win10v2004-20240221-en
General
-
Target
Aurora V3.1.rar
-
Size
8.4MB
-
MD5
78c008deb73339bf6b6511dd4fbf887f
-
SHA1
1e51b31755a5eac9fd144b346ee2cc54873e4f71
-
SHA256
fd92e0029c3d4430b2d734f374d823c588bd1f3633e931944d3450d5263663dd
-
SHA512
1b322afb56ab9d55d4757d427bbcc40e4b50158263fd08585fd57a7c2d4d0575269e546f32414fd3525c251140e94625b3146f3392f24f676fb0405b6a754029
-
SSDEEP
196608:/4r8un8Pomzo7p+GmcSLkyARVaj0nhMz+WtA7GJOhRWCE9B+ft76Q6ouP:Rj3mTm1IyARhG+OJxCgBg2Q6oU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7zFM.exedescription pid process Token: SeRestorePrivilege 2196 7zFM.exe Token: 35 2196 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7zFM.exepid process 2196 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2076 wrote to memory of 2196 2076 cmd.exe 7zFM.exe PID 2076 wrote to memory of 2196 2076 cmd.exe 7zFM.exe PID 2076 wrote to memory of 2196 2076 cmd.exe 7zFM.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Aurora V3.1.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Aurora V3.1.rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2196