9f469162158328f458c779eb75ac7b6261112dc76092ff4a0c048dcfb528c225

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

release.rar
Size

11.5MB
MD5

1512cd25a9738012af8cf107ba85401f
SHA1

50cb1dd227ffcbeeff3fd59955aa79aaa9f8a567
SHA256

9f469162158328f458c779eb75ac7b6261112dc76092ff4a0c048dcfb528c225
SHA512

a60efc426e03b43b9abbdc1dc19d2e5db9eccaf2f97604ab407f2140d826b74b8fe5e3096093722906d9c69558682e2f2340099be0ba1702ad5ca98a83032ef2
SSDEEP

196608:f4+J9lSadReUTHs57kMo82ViP3zYxAvGUFi0gpuKLoqizxw139o3IVTiypXyGd:f4+J9ljdReUTMJ9Ou3z8A+UA0gxLonze

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2728	1636	cmd.exe	29
PID 1636 wrote to memory of 2728	1636	cmd.exe	29
PID 1636 wrote to memory of 2728	1636	cmd.exe	29
PID 2728 wrote to memory of 2644	2728	rundll32.exe	30
PID 2728 wrote to memory of 2644	2728	rundll32.exe	30
PID 2728 wrote to memory of 2644	2728	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\release.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release.rar
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release.rar
    3⤵
    - Modifies registry class
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads