f6d439b28fcb5f5ba472e3fa3cc133f8067e34c05b1d358a1a61e75696c1dbad

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cpvp/data/raids.gz
Size

90B
MD5

5dfbca3b8751f2b51d05acaab58adc89
SHA1

e725afaadf305697db598757c4ed35ed2dc4fb27
SHA256

3f7e8c84e1d0dfbc638f80f6efa74e3a96dd992cb836d1e3794961b47a72d3b9
SHA512

39fd6031e35d0ccd0ee07f955b680ce20acfd8ba55eb378f3fb376debf7eb826db5cc32408c9bbd722766f2018ef6cec66528da57438c9fdb26af23d6e033244

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2608	7zFM.exe
Token: 35	2608	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2608	1680	cmd.exe	29
PID 1680 wrote to memory of 2608	1680	cmd.exe	29
PID 1680 wrote to memory of 2608	1680	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cpvp\data\raids.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\cpvp\data\raids.gz"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...