b8e050bfd5ac58c6f0c0fe2ca1cef4e4e9c1fb8099c73c84269cc6290240765e

Resubmissions

25-06-2024 13:49

240625-q4sxgstcpc 10

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mystic Release.rar
Size

37.9MB
MD5

29012d69065e9e345e589db37368d8e3
SHA1

5a83d9ae2478486eb0d1278c0da7d615ecd3cf64
SHA256

b8e050bfd5ac58c6f0c0fe2ca1cef4e4e9c1fb8099c73c84269cc6290240765e
SHA512

64f6a98195b1f34183f0dbe5a3d9c384805a1978d52a10ad9b4ca32a452cca35682b4ade91cb8d9666e16577f2e464b09345a1a46e8d8530e79d3a5e580db9f1
SSDEEP

786432:tioOWnPIMBvKW9RJjI1dC8OYRvc76kxhcVt/vRP:taW/RPJE1dC36oh6tF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2596	7zFM.exe
Token: 35	2596	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2596	1904	cmd.exe	29
PID 1904 wrote to memory of 2596	1904	cmd.exe	29
PID 1904 wrote to memory of 2596	1904	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Mystic Release.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mystic Release.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads