a6ca3a16b0938b1348ca5c571a6bfb041fca72bee8cc5fef77df6e18853e6bd6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 21:10

Target

BLACKSOFT.rar
Size

5.5MB
MD5

be932b62260eaafae6e10a36d55f9b91
SHA1

a251db4aee1d8a9444ecc59493f8794daf69fdc0
SHA256

8258b4d438d9f2ac2cf3cff29e1f59fdcfae8436e1cfbcd4c811b260514121dc
SHA512

bee8059076a70b5e3fb2d39d8672532d20c3acfb2a7c8124ed46fae4b135c0579f4ce37b82d6c7b15f5554c9c28720ce85ee5945de5f252e24fd4ff77486dfeb
SSDEEP

98304:VtlOZm+7rK63WaQwzYgQWKBmwVTH3x+eKtiCmYnzFdnAXfVs2D8qCT:vlO8+vKUZxzUWKBmwdXxEiYnzUl8qCT

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2588	7zFM.exe
Token: 35	2588	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2588	2372	cmd.exe	29
PID 2372 wrote to memory of 2588	2372	cmd.exe	29
PID 2372 wrote to memory of 2588	2372	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BLACKSOFT.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BLACKSOFT.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2588

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact