d081165a2b369387a4161ff1be291cb532797dd16044e4b0994614e97bf9bd4f

Analysis

max time kernel
138s
max time network
177s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
05-03-2024 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Macrium.Reflect.8.1.7847.x64/Macrium.Reflect-Cleaner-hawk007.rar
Size

1.2MB
MD5

4daaf336395d622e3bfee309d0a457a2
SHA1

e4ebc7e6332127a1c991d30fa74e2a4f0a54bcd3
SHA256

05e657223f226008280358ea1338fea588a288b992ed7a5d78169266830d205f
SHA512

fc70c5b8d0f7f00c16028efd4dc6e81e48d4acfb84f68061213095375b8884dee83e12cc4f6757078e8116370ecd7ec8397408a3656736d02756ca911ef4b0dd
SSDEEP

24576:PVmAImcwkayuf3px9rKwAFvspmelsHsthUHHqiMpQyKdQ33fZNSH6RlJ40BIPf6G:Pgmc1aff3p/Ktt8meiHsrUHH/sbHRQHf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2864	7zFM.exe
Token: 35	2864	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2864	1316	cmd.exe	78
PID 1316 wrote to memory of 2864	1316	cmd.exe	78

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Macrium.Reflect.8.1.7847.x64\Macrium.Reflect-Cleaner-hawk007.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Macrium.Reflect.8.1.7847.x64\Macrium.Reflect-Cleaner-hawk007.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads