bb76d76af8aeb847aa6ba37f3eed8cd71a5c3824d624e7115ca1ecd56a3d68b7

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lethal Company/Fix Repair/LethalCompany_Fix_Repair_Steam_Generic.rar
Size

9.6MB
MD5

c6974d01ebcc0fab46aba9ac18b18c93
SHA1

47f6671f56e04aa5b81e525edf8f7a548f3fb01e
SHA256

8927feb379fc01054122913c6aba17dfda0fc4ae2a2112b069ebcdd5ea7a41f0
SHA512

ba1074d1c32ac38387f7c2f9a826aafbd4fa8dc89a1ecf0101e88c97d0c06279ed4eee771ab780dfa1bd50f79ebf6bd3c9e577e4e702d4953ceaa6d41d43a538
SSDEEP

196608:9IvdYuIFKnmJtywc/mTLn83/U9MzF0j2tJzbwJjsuMqFaSwHLYdjtlA:aOuIFFbOCT83/iMzF3JujsuMqFVwrYzS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1640	7zFM.exe
Token: 35	1640	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1640	2740	cmd.exe	29
PID 2740 wrote to memory of 1640	2740	cmd.exe	29
PID 2740 wrote to memory of 1640	2740	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Fix Repair\LethalCompany_Fix_Repair_Steam_Generic.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Fix Repair\LethalCompany_Fix_Repair_Steam_Generic.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...