3f45b4acd905e47dbc1357ec44040af6e1fcb68fd09d8bacccad0d729be1d5da

Analysis

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ElectronV3.rar
Size

11.0MB
MD5

fae8140fc10e55657ec9998ed3f32a30
SHA1

d27f46d9e120453a13c7f29b3833ec8ab660d3db
SHA256

3f45b4acd905e47dbc1357ec44040af6e1fcb68fd09d8bacccad0d729be1d5da
SHA512

ef4fef5be5a9548446c385a948286e47b1582ce2c355324618b905d2572b6d3d44a5a79f1a73238439e6d2f941a0628b1e0d68b01c82c2a95ea81d6d7e70444f
SSDEEP

196608:EtWMBvqCsY56Pmf9niNjK1hP5dimc6O4kzIEYZa337rmcc3EV2c+LSneFrhf1Z:EggFs49i46xUh637AuVOS4rhf1Z

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2684	2180	cmd.exe	31
PID 2180 wrote to memory of 2684	2180	cmd.exe	31
PID 2180 wrote to memory of 2684	2180	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads