Analysis
-
max time kernel
1082s -
max time network
1792s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-10-2024 17:40
General
-
Target
7-zip/7-zip.exe
-
Size
54KB
-
MD5
7f06dcc4844532ba0d64812e6dca5240
-
SHA1
76527c1ddb0bf3e64dd1ce3ff6aa0708e09366e1
-
SHA256
ab91de964c96b6a6903fa52419fbb17a2c1fee6817f5704a07db4edc9855e72e
-
SHA512
93d1b8f22e30ed55c95493f164052bbc4db2c164dc66300fdb8d72df02bc8d1c01aef8bc5b0f2fc7fb1d3786a31229fdc22cd3f457aaec2d3f5f11760b618156
-
SSDEEP
1536:HtvrImfzoXK6DDvvvDvpvZMt+pan/opg6F2:lImfzoXK9/o6d
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7-zip\7-zip.exe"C:\Users\Admin\AppData\Local\Temp\7-zip\7-zip.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow