bb76d76af8aeb847aa6ba37f3eed8cd71a5c3824d624e7115ca1ecd56a3d68b7

Analysis

max time kernel
97s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lethal Company/Fix Repair/LethalCompany_Fix_Repair_Steam_Generic.rar
Size

9.6MB
MD5

c6974d01ebcc0fab46aba9ac18b18c93
SHA1

47f6671f56e04aa5b81e525edf8f7a548f3fb01e
SHA256

8927feb379fc01054122913c6aba17dfda0fc4ae2a2112b069ebcdd5ea7a41f0
SHA512

ba1074d1c32ac38387f7c2f9a826aafbd4fa8dc89a1ecf0101e88c97d0c06279ed4eee771ab780dfa1bd50f79ebf6bd3c9e577e4e702d4953ceaa6d41d43a538
SSDEEP

196608:9IvdYuIFKnmJtywc/mTLn83/U9MzF0j2tJzbwJjsuMqFaSwHLYdjtlA:aOuIFFbOCT83/iMzF3JujsuMqFVwrYzS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4056	7zFM.exe
Token: 35	4056	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4056	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4056	2632	cmd.exe	92
PID 2632 wrote to memory of 4056	2632	cmd.exe	92

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Fix Repair\LethalCompany_Fix_Repair_Steam_Generic.rar"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Fix Repair\LethalCompany_Fix_Repair_Steam_Generic.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...