bd0ef1d7654394b817189894517246b9e5e6e818c3de3c257987370e08ebbe6f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RoPro_Updated.rar
Size 3.2MB
Sample240608-klj9qsbd98
SHA256 bd0ef1d7654394b817189894517246b9e5e6e818c3de3c257987370e08ebbe6f
MD5 9edaad4ec627f61edc361fc6839282d1
SHA1 907192571caa4deffdc4b4969076596c7a20ee47
SHA512 6d8f64dd5853668930b05cdd8ba1e426e5f46c06465b67b4a8e65bd9e8d184ae732f5ba68051f8ee21323954e5c65ed14181da4b21c49946d882617dae2e0cc5
SSDEEP 98304:41TyUwaqr3zXSGbRYmoHIbL/5T7Dsr5Lwm0WrdNM:iDwa+D3umoHIbLVDsrRwm0AdNM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2632	7zFM.exe
Token: 35	2632	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2632	3048	cmd.exe	29
PID 3048 wrote to memory of 2632	3048	cmd.exe	29
PID 3048 wrote to memory of 2632	3048	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RoPro_Updated.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RoPro_Updated.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads