Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 08:19
General
-
Target
release.rar
-
Size
8.1MB
-
MD5
550f5e261d58b60ad66fe0303e3a1234
-
SHA1
69bca3605b33b4043e0c730b73ceee2a596db82d
-
SHA256
d414a91153d3003d9026994389a629203aa3f8fc83017f0e727273560315e181
-
SHA512
14f157e0d1f44dacd12b5a6f13583d156a8b261956e97d47cc014536709f4402eb303f26b58ea6987323afa88ffa0b2332d5f6efa0eeb620afd35905f1309b40
-
SSDEEP
196608:E7BFRsgkFbyhlu0X4f0ZvpBxAvGUFi0gpuKLoqizxw1j:EVXsg2byTu0NBA+UA0gxLonzG
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\release.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release.rar2⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release.rar3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam