08d4791b57ef75238dde91591094e1700377e86e9c78f4f0b59bc2ebd0549c80

Analysis

max time kernel
1357s
max time network
1148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 17:25

Target

mariopet_alpha.zip
Size

46.2MB
MD5

4a858d456637b45982065fc79c523173
SHA1

39a4c99e8f8d414ecb7389318c7c93cf492aa7b9
SHA256

08d4791b57ef75238dde91591094e1700377e86e9c78f4f0b59bc2ebd0549c80
SHA512

e78baf97247723e19b984ed045c97c3cb339ef071e1a16784ff4de4ed65c6dfec7b86dda3e7c1fa5dac604a567b9764d632ea41016be044f64e1f1b91615cfd4
SSDEEP

786432:udwAB/U5B1R5lUsiqoeSVxIikZIquo84EnI2QQc805ROIF5T5xtreNsa:udwo/U7D4oZIqj84EI2D05cIT4

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3680	7zFM.exe
4944	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3280	4944	7zFM.exe	100
PID 4944 wrote to memory of 3280	4944	7zFM.exe	100

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini
  2⤵
  PID:3280