d99a4235a892a56068898d16f9da8ecaa0d3c3aa66ac8e94e5842fe28100c187

Resubmissions

29/03/2024, 10:52

240329-myteaafb6z10

29/03/2024, 10:50

240329-mxb4lsfb3y7

Analysis

max time kernel
361s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
29/03/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extrimhack_free_15.03.2021.rar
Size 6.5MB
Sample240329-mxb4lsfb3y
SHA256 d99a4235a892a56068898d16f9da8ecaa0d3c3aa66ac8e94e5842fe28100c187
MD5 731dacb017b828e75a51e24e68fbbb7b
SHA1 8d6d7327349cf62a59be698b320d765616032149
SHA512 b9fac9fde345c24e2cb03760d30fa9d44cdfc52e65184fb4db99dab000bad52f85d655a97c2370713ce5fb33cd1daa8bd98992a9b8e80cf9f44e3e1496de606d
SSDEEP 98304:0BF3dZChe20RQlWra0U5ntpZMfSwVPK7xIPWsm5Ml1IaGaNGOgI8YbTyHwxiOanM:Q3dchL0RQi2x9h7xIPjPl1RNqItvC4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	224	7zFM.exe
Token: 35	224	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
224	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 224	4212	cmd.exe	74
PID 4212 wrote to memory of 224	4212	cmd.exe	74

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\extrimhack_free_15.03.2021.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\extrimhack_free_15.03.2021.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads