c53183b62670d1d9570207253fcbb96d29b568850fede53a9f27ff0812524d24

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_Getintopc.com_ReFX_Nexus_3.4.4.rar
Size

8.6MB
MD5

421f5d69db75ebd2280f3af213b39e87
SHA1

cc0ed00d01f21ddc21317f04101c26dc9f2ee0f2
SHA256

c53183b62670d1d9570207253fcbb96d29b568850fede53a9f27ff0812524d24
SHA512

b2d63574cd6eb7097e9e148196e918546401929a01c27c8c34ea5517df12abecba62b59f8da998b67a749fd16245087517f4eb9c50dd20d18a9a664d89033cf4
SSDEEP

196608:FZD2sG8I1BgYHX8GqKrmux50puxF7dZFPJqnt3Go8gJKh+tC:D2GgBgY38GqKrmuYpuhZFPJqnx8gpC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2800	2460	cmd.exe	32
PID 2460 wrote to memory of 2800	2460	cmd.exe	32
PID 2460 wrote to memory of 2800	2460	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_Getintopc.com_ReFX_Nexus_3.4.4.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_Getintopc.com_ReFX_Nexus_3.4.4.rar
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...