1463d34ed4b98b56cc294874749da5604cc67bf422420aa240d6b2f9e77221e3

Analysis

max time kernel
124s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
18/03/2024, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Logs/adaptive_policy.4.log.gz
Size 316KB
Sample240318-yeazdagf52
SHA256 f080f28762cefc9232237582216cc1d0302a144b48d618e1cf196b39461f27f8
MD5 004adea13a3277e9fe740122653cd43c
SHA1 d0009553ea2f92e31d4c2c9e362902a828af2e7c
SHA512 8c94e19b9d8e650f1452930170e6843fb5becd6b8ea9f96c1f0f0fd08c9fcd7184b08c25eed52e84f42c6f226e0e418e55f8c04de68f591ff1d433af64fc6572
SSDEEP 6144:oA47aSNuqM0DT2eXlbaDna/FM3AHEsDpGPLSd+YfikwgWDDiTgWwR:E7Bk0OilbaDa/KQkkcjSgYf6dCcWU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	96	7zFM.exe
Token: 35	96	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
96	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 96	4992	cmd.exe	75
PID 4992 wrote to memory of 96	4992	cmd.exe	75

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Logs\adaptive_policy.4.log.gz
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Logs\adaptive_policy.4.log.gz"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:96

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads