dbac48c0a8d2b08dc7362958de29ca782d749becd8c0ea71fe3a95d555399e69

Resubmissions

10-04-2024 12:50

240410-p2341abd2x 7

10-04-2024 12:42

240410-pxn5aaga44 7

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NOTIFICACION PROCESO FISCAL; RAD.8747000-2024.rar
Size

1.1MB
MD5

0a55f6631599adcda91ee0ff48283eae
SHA1

7adc2fde101b5e746cb2e788118c23582794ef4a
SHA256

dbac48c0a8d2b08dc7362958de29ca782d749becd8c0ea71fe3a95d555399e69
SHA512

c9ea51e64ac4586c6cc23e61252cc1aced253fa5573f36c7eb862fce6d140701333a2e49edcfcfc5b46396d2af609fbbeefeb218c6548f6f92e9ca097e855255
SSDEEP

24576:kHKrz8p1dsZ2DVZ6R98PZVoX5FOutLC+KJ6kPHq9bRLAv:hz8pbZDVZ6wPajtnkiDY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2572	7zFM.exe
Token: 35	2572	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2572	2056	cmd.exe	28
PID 2056 wrote to memory of 2572	2056	cmd.exe	28
PID 2056 wrote to memory of 2572	2056	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION PROCESO FISCAL; RAD.8747000-2024.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION PROCESO FISCAL; RAD.8747000-2024.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads