d184c7fac35e68924cf520d33fabc0703198756e096592dd31eec6101b5551e5 | Triage

Resubmissions

10-10-2022 17:13

221010-vrjkhacggj 10

03-06-2022 21:56

220603-1tra1seah3 1

03-06-2022 21:55

220603-1swt4sabgp 1

03-06-2022 21:38

220603-1hbq7adhf4 10

03-06-2022 21:28

220603-1brttsdha7 10

Analysis

max time kernel
165s
max time network
167s
platform
windows10_x64
resource
win10-20220414-en
submitted
03-06-2022 21:28

Sharing

Report Analysis Logs

General

Target

oFWkRTFwjm.zip
Size

1.9MB
MD5

972038d369ec6f134fc9b6c617adc328
SHA1

0b74896a84f8e22645d8518135836ea22ae98cde
SHA256

d184c7fac35e68924cf520d33fabc0703198756e096592dd31eec6101b5551e5
SHA512

6ffeefd8c13785500a546e114cd766c8a2b804723511e2bb5ebeca1c5bfe44349b8c91695ac97bcf2da2d77c01530247f771655b132c649fdd9e00e710b4d8af

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2616	7zFM.exe
Token: 35	2616	7zFM.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\oFWkRTFwjm.zip
1⤵
PID:2880

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads