Analysis
-
max time kernel
45s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 12:01
Static task
static1
agilenetguloaderinfostealerminerpdflinkbackdoor888ratgoldbackdoorguloaderm00nd3v_loggermatiexnetfiltersnakekeyloggerxmrigardamaxsunburstmetasploit
25 signatures
Behavioral task
behavioral1
Sample
Windows 7 x64-000008.vmdk
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Windows 7 x64-000008.vmdk
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Windows 7 x64-000008.vmdk
-
Size
387.1MB
-
MD5
3a620b8bf0012bb9903129b83ea86bd2
-
SHA1
e4ec9d6fcdcca77ff5dbb0c8e5983da73788a9a2
-
SHA256
e1d963b95b58056f2bc2ccddad4482df16c8a147f8a2bcbcc104d672fe104886
-
SHA512
21275ffad6c86c8bb68bac19ab7ed9e0b3653d479a9ebd775bf2efa04e9799ec8a8fc4a59cb0c63fd796dfe754ed2387fd152bb984aa30d5fccaa6b24b64c2ee
-
SSDEEP
3145728:tDFaInFN9a31Cs/rJdmcrfKJd8vxdOxzZIV5VUnXAY:LzsR/rJdvQd8vXMZIzynF
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid Process 4352 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
7zFM.exedescription pid Process Token: SeRestorePrivilege 4352 7zFM.exe Token: 35 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
Processes:
7zFM.exepid Process 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid Process 5076 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Windows 7 x64-000008.vmdk"1⤵
- Modifies registry class
PID:3496
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5076
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 7 x64-000008.vmdk"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4352