3d4c345b9b6c298b218274cfe2141b2f2842b113534a557100c1671a8b7edb76 | Triage

Analysis

max time kernel
314s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07-09-2024 17:26

Sharing

Report Analysis Logs

General

Target

Malware_pack_2/000.zip
Size

119KB
MD5

d113bd83e59586dd8f1843bdb9b98ee0
SHA1

6c203d91d5184dade63dbab8aecbdfaa8a5402ab
SHA256

9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8
SHA512

0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5
SSDEEP

3072:QxpL6ECUOVjuZ6HwZ3KMh8N73lLrKG+PE9g4CN33:2961UwjuDZn65nxIE9y33

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4728	7zG.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4728	7zG.exe
Token: 35	4728	7zG.exe
Token: SeSecurityPrivilege	4728	7zG.exe
Token: SeSecurityPrivilege	4728	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4728	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Malware_pack_2\000.zip
1⤵
PID:988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\TestClose\" -ad -an -ai#7zMap10887:76:7zEvent7470
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads