e10e4e255af0ba3293aed0222096b70d627a0a8217f1d3d76c2d6813e3074144

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

69.5MB
MD5

cfe7e3f1765e73ad4dbdd224dcef3ff5
SHA1

4ee16b2373fc88cc1dda286f0dd4fbeccf3089ca
SHA256

4503105d87564d085a9065a3755acedd296f54c73fc14d878f7fe0b2bebde5e6
SHA512

5179defe5c74a810b3c166d4fe10247bfdcdfc53c1a37d9c80f226094970234cb1e1b0d23e67f1ddffe8572c94500c327a3fd8a7bffa706b7bf20aaad27a2288
SSDEEP

1572864:LnjRkJ7cQG4Cfwn3Hi0MoXGeLxwTR5Tlpl+YfYVD9bIHIjyshvOWUMT+Q:HRdQ133MG3STzRpQYfKD1jR2FMTF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2552	7zFM.exe
Token: 35	2552	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2552	1732	cmd.exe	29
PID 1732 wrote to memory of 2552	1732	cmd.exe	29
PID 1732 wrote to memory of 2552	1732	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads