e3d958c0be09c74f6ae0a947388ad2a52be5d149fa682badcbb24338fb0edc38

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app-32.7z
Size 63.4MB
Sample240509-k5e45aab91
SHA256 a9f4f1f626a680e2ba48bc687784c07468ccb401fd44e913151ce950b8299944
MD5 fae942a0e80161252600dcf814ecf104
SHA1 8dcaed1a50446b0dc6344da0ebfcecfefdbd0f9e
SHA512 60e781958bdbd74ba7afb2633b51b597446533867497625686b51a8f68a232775f93cd526949043c5ac1458849087fb5538837e6ac6ff13c14bd3dd13d512d16
SSDEEP 1572864:QejOYfRPhvA6BqNPcBiXHo2fpUfjt9c4HWPb79Emj:Q4TB6PcBQHHfSj2z7Ga
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2568	7zFM.exe
Token: 35	2568	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2568	2036	cmd.exe	29
PID 2036 wrote to memory of 2568	2036	cmd.exe	29
PID 2036 wrote to memory of 2568	2036	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-32.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-32.7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads