072ae063625482dc3918e8e5af3d03c39778fdd599dab11025f9e2e136ec7f06

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 21:31

Target

DVResolve-RPC.v1.0.7z
Size

305KB
MD5

8284ec075b790ef4a95ce26346533bcd
SHA1

d6a8c5224be0e2fb218115cd8d027c126d728f7a
SHA256

072ae063625482dc3918e8e5af3d03c39778fdd599dab11025f9e2e136ec7f06
SHA512

b90fdba1a53e4cb0298e78004368c603bb66efc1a31a1de18fc17fda89a4fc082f7e35063b6960bab1f0360e35c51eb007bd786c8c09af0172e6fd42d0399809
SSDEEP

6144:Yl3YAZKWwuX7kfWp2HY1GNGVRvU9RxTEQ25IFuNmATppeAYihOH8CxYX0:YpYqwPE2zRLu5OhATpDdhOH8jX0

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

DVResolve-RPC.exeDVResolve-RPC.exe

pid process

2480 DVResolve-RPC.exe
2740 DVResolve-RPC.exe
Loads dropped DLL 9 IoCs

Processes:

pid process

1224
1224
1224
2520
1920
1224
1224
1224
1224
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2304 7zFM.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2304 7zFM.exe
Token: 35 2304 7zFM.exe
Token: SeSecurityPrivilege 2304 7zFM.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

2304 7zFM.exe
2304 7zFM.exe

pid	process
2480	DVResolve-RPC.exe
2740	DVResolve-RPC.exe

pid	process
2304	7zFM.exe

pid	process
2304	7zFM.exe
2304	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2368 wrote to memory of 2304	2368	cmd.exe	7zFM.exe
PID 2368 wrote to memory of 2304	2368	cmd.exe	7zFM.exe
PID 2368 wrote to memory of 2304	2368	cmd.exe	7zFM.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DVResolve-RPC.v1.0.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\Desktop\DVResolve-RPC.exe
"C:\Users\Admin\Desktop\DVResolve-RPC.exe"
1⤵
- Executes dropped EXE
PID:2480

C:\Users\Admin\Desktop\DVResolve-RPC.exe
"C:\Users\Admin\Desktop\DVResolve-RPC.exe"
1⤵
- Executes dropped EXE
PID:2740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\Desktop\DVResolve-RPC.exe

Filesize
163KB

MD5
5c2e8b94738262fcb3088c825889509d

SHA1
16a16978218888e4298776ee6f4c39cf4b79fdc8

SHA256
0aee63a30c6df7f79f940d05818ca46bcab5253a97679c8bf0e91cb22199f1cb

SHA512
890536418656c672e47b449702f79c6ebe12a97559efbd2fe48c7bf21d985f8f6e2610f9145e826c84ea29b1280fa782ada6d12049c630f71affc1d8bdcc9bdd

Download Submit