Overview

overview

10

Static

static

3

main.rar

windows7-x64

7

main.rar

windows10-2004-x64

3

main.exe

windows7-x64

7

main.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25-06-2024 08:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main.rar

  • Size

    35.3MB

  • MD5

    67f7aa6f2b2df238fdf2e86320c57627

  • SHA1

    4bc27a525f9c759206a4368ba4e26d2bdd92a78e

  • SHA256

    f2e5a0cd3ad67ce08355c82525410f94484becd9ab5290245baad29633506b18

  • SHA512

    c473813639c5bed6e3077470e1edf796a934a6682a3abaa69da27075842c9616da12637a24ebddc80dec3e3a323dc036d88449c44e638aecc14ea677b28fb0a4

  • SSDEEP

    786432:747w19qKQ+an4fVczORv3fJhZBdH7Qes/Z7VH:M7w1bxA4deORHJhZbH7QX/tZ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\main.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.rar
        3⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Program Files\7-Zip\7zFM.exe
          "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\main.rar"
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Users\Admin\AppData\Local\Temp\7zOC962AFA6\main.exe
            "C:\Users\Admin\AppData\Local\Temp\7zOC962AFA6\main.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2136
            • C:\Users\Admin\AppData\Local\Temp\onefile_2136_133637774686250000\main.exe
              "C:\Users\Admin\AppData\Local\Temp\7zOC962AFA6\main.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_2136_133637774686250000\main.exe
    Filesize

    43.4MB

    MD5

    6e9d3e1015a944dd20120d792ec80453

    SHA1

    9f490e82a1329d73c3117e61fee3de89004b08c7

    SHA256

    e8f1c1b00978443e9808e9671bbf8c8b402311cc3f1086b99d3c7970476df82d

    SHA512

    73b3342a6db4eb8155fa62bbf1c31a205a25bff12e9053a7c1d1a7b2feba2d3fe2db38e1245e8b6fd498ede373bb56d2456d821a0c317c4ca4b1738e6bdeae00

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_2136_133637774686250000\python310.dll
    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\7zOC962AFA6\main.exe
    Filesize

    35.4MB

    MD5

    2171c1030c8ef81b3d358519af67de82

    SHA1

    3ddf1d2798d351c6176d17d618d8e4572abe05e5

    SHA256

    e9cc790d80084d871196a56fc53f02a82ecc58c2e1321c07fa6db01002c5c04c

    SHA512

    a65ff90ba63e43a5784a79e422d094082a4e78baa3e52593f624a41c3c47e6f1f03d0693c328d001bdfe5fc05b957400d5293cce88784eb91e78f032ded5bd6d

    Download Submit

  • memory/2688-24-0x0000000003F50000-0x0000000003F60000-memory.dmp

    Filesize

    64KB

    Download