Analysis
- max time kernel
45s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 12:01
Static task
static1
25 signatures
Behavioral task
behavioral1
Sample
Windows 7 x64-000008.vmdk
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Windows 7 x64-000008.vmdk
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Windows 7 x64-000008.vmdk
- Size 387.1MB
- Sample240622-n681da1dnr
- SHA256 e1d963b95b58056f2bc2ccddad4482df16c8a147f8a2bcbcc104d672fe104886
- MD5 3a620b8bf0012bb9903129b83ea86bd2
- SHA1 e4ec9d6fcdcca77ff5dbb0c8e5983da73788a9a2
- SHA512 21275ffad6c86c8bb68bac19ab7ed9e0b3653d479a9ebd775bf2efa04e9799ec8a8fc4a59cb0c63fd796dfe754ed2387fd152bb984aa30d5fccaa6b24b64c2ee
- SSDEEP 3145728:tDFaInFN9a31Cs/rJdmcrfKJd8vxdOxzZIV5VUnXAY:LzsR/rJdvQd8vXMZIzynF
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4352 7zFM.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeRestorePrivilege 4352 7zFM.exe Token: 35 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe Token: SeSecurityPrivilege 4352 7zFM.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe 4352 7zFM.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5076 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Windows 7 x64-000008.vmdk"1⤵
- Modifies registry class
PID:3496
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5076
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 7 x64-000008.vmdk"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4352