0ba75e731377c4f2f1b9f9eeec3abcdca3e94c4096eab6db777bc8d46f9ebf33

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01 PROCESO JUDICIAL/onestep.rar
Size

646KB
MD5

3b0d1f17f9e0364574d4d252ac05206c
SHA1

58c2136529363b08b7b407692de402fa4e675177
SHA256

89079b6d4816236926c38318ac53a0177b5684ffd11ae388a2963158c0722506
SHA512

f469b5204528d5841aa5ff9e4eb1688a6bad181f350f352b2b645ae17df5a9a400275ef39573a3f0d701317751338bc8a07f1d51e4f652283e002a28b7201fae
SSDEEP

12288:dFnscV5vN0JaL9gyI2QSejbYWcLxM4OBNbf/UsgSU:DlJtRWjbjpWb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2628 7zFM.exe
Token: 35 2628 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2628 7zFM.exe

description	pid	process
Token: SeRestorePrivilege	2628	7zFM.exe
Token: 35	2628	7zFM.exe

pid	process
2628	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2936 wrote to memory of 2628	2936	cmd.exe	7zFM.exe
PID 2936 wrote to memory of 2628	2936	cmd.exe	7zFM.exe
PID 2936 wrote to memory of 2628	2936	cmd.exe	7zFM.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL\onestep.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL\onestep.rar"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads