7a8aee0ff7f0eb5c8eda7fecdad3616e44adf6da1cd89dac50ae7e322f9d9ce3

Resubmissions

10/11/2024, 07:05

241110-hwwpeavnhn9

10/11/2024, 07:04

241110-hv96easbml9

Analysis

max time kernel
25s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New folder (4).rar
Size 1.1MB
Sample241110-hv96easbml
SHA256 7a8aee0ff7f0eb5c8eda7fecdad3616e44adf6da1cd89dac50ae7e322f9d9ce3
MD5 356f6e8762d1d5bc83d902e5d75e0533
SHA1 82a22059cac559ceb65019edf0b6ff0d4bb17bcc
SHA512 8747c1ee01dd7fe2d0e09354c3fd24b273aca7dd4c2bd9117a515b5e626d6397913bba45c32e05d5de5a3e19bccd988256244c1a671cc55b31c3796a902c92c1
SSDEEP 24576:LkxtJ6z9Gt46DvZsUuA3lVVBnM/CMp/cmRHm1E06Bbq:Lk389Gt46DBsRMlVMaMp/FH9Bbq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2744	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2744	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2220	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2220	7zFM.exe
Token: 35	2220	7zFM.exe
Token: SeSecurityPrivilege	2220	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2220	7zFM.exe
2220	7zFM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2484	2220	7zFM.exe	29
PID 2220 wrote to memory of 2484	2220	7zFM.exe	29
PID 2220 wrote to memory of 2484	2220	7zFM.exe	29
PID 2484 wrote to memory of 2744	2484	cmd.exe	31
PID 2484 wrote to memory of 2744	2484	cmd.exe	31
PID 2484 wrote to memory of 2744	2484	cmd.exe	31

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New folder (4).rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zOCA861468\robuxboi.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robuxboi.bat

Path C:\Users\Admin\AppData\Local\Temp\7zOCA861468\robuxboi.bat
Size 7KB
SHA256 6cfb933d54ecd331128570b9ed31c25a7520dcd70fc8cbac041f78c90abaa509
MD5 65dcdf6be470f4b69915c4cbf7c10877
SHA1 e480cf30454a0f5c09ac73cdf72192a1abf26713
SHA512 3f8e19f84bf4789c91937c902c799ae59c29b8087176f6d02d22bde2b0336fed58377b82df4c72f532ce99714ee1d885b325a01fbec267bdf981d6d58038b567
SSDEEP 96:dy1jI+hFjju23zX0FoyFaIU7yeevW5My0FEvVkv2vt98JQyFjKq1eGWWg:dKLjaQzX0aaaIK70FKVPP7ysCzrg
MD5 SHA1 SHA512 SSDEEP

Submit Download