e3f036ecd6f6b22ed68fdfa2c6e211a3ad0b2efd4b202c51e1a94dcc343e6bab

Analysis

max time kernel
1561s
max time network
1573s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bitcoin+Fake+Transac...rar
Size

304.8MB
MD5

276e47ce2deff90b6e7c0ea9496b91bf
SHA1

a139f00c2224303a5966a4e640ba62e0b5093bba
SHA256

e3f036ecd6f6b22ed68fdfa2c6e211a3ad0b2efd4b202c51e1a94dcc343e6bab
SHA512

90af10dd5d1f1916492518cbacd162bfabceae26d6f8681e5dde517c3e24cb8d04280bae41dd947e5462ab00d22ec9113f19bc323c15ce40bfdaa3861e3d3e9f
SSDEEP

6291456:2PE5JH1U8fbAZiTS7a5Wq0haXAeldkl9uivCVaVfR/JSiYI8z8MZhekn+mq/HWlg:qUpLS3LoXAEdCjVfR/JWI8z8MZheU+mO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3020	7zFM.exe
Token: 35	3020	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 3020	360	cmd.exe	29
PID 360 wrote to memory of 3020	360	cmd.exe	29
PID 360 wrote to memory of 3020	360	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Bitcoin+Fake+Transac...rar
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Bitcoin+Fake+Transac...rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads