Analysis
-
max time kernel
1561s -
max time network
1570s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 19:10
General
-
Target
assest.rar
-
Size
24B
-
MD5
c69d0b5902a959577c02e9dcdda77de0
-
SHA1
6233724f8b3ac18649dc248d1c778e2bca78a7f2
-
SHA256
4301ec2e9592e7a22262d1c046954545033b73be322b33a8117d201556c4254b
-
SHA512
2e8945172ef567d4ae84d6317efce63502a6d9496caa48b8dc09cf12d1ceec3e89d033d6d9fceeba82f403107d15341bcdb72b4a6f60ba3e6df4d2a2cb6e48cd
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\assest.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\assest.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-