b07325c28fc9f6216b7183948976b29b6e00529356268dca48cf27049f4515cb

Resubmissions

11-04-2024 15:37

240411-s2hd3shg2w 7

11-04-2024 15:36

240411-s2c5cshg2s 3

Analysis

max time kernel
837s
max time network
837s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release.rar.7z
Size

1KB
MD5

84d209ee83cf324e4c7d9a28288fbd85
SHA1

2307e4d5f3cc6420587b491059415418c4e424d9
SHA256

b07325c28fc9f6216b7183948976b29b6e00529356268dca48cf27049f4515cb
SHA512

8f65d02be3fc7a9ac48dc0dd9192aa9a57244ca6a0a0768329dfd90ed27a1a15917d89462d6d9a1ee11fac42b38487b6e5dd3dcc562103cabf4e92e5f0fd2f91

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2604	7zFM.exe
Token: 35	2604	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2604	2240	cmd.exe	29
PID 2240 wrote to memory of 2604	2240	cmd.exe	29
PID 2240 wrote to memory of 2604	2240	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Release.rar.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Release.rar.7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads