24ce130b562da57a05a109de44a6003525fce390a18cc251d1b66d71f83090f3 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 19:26

Sharing

Report Analysis Logs

General

Target

RetroNite.rar
Size

3.0MB
MD5

9723e1bcfc2cb5ce1230374739cdd556
SHA1

8cabfff624ecda75858d4e500f8071fa9d752b5d
SHA256

24ce130b562da57a05a109de44a6003525fce390a18cc251d1b66d71f83090f3
SHA512

295deaee51bda306e463d6804bfcfb54b8bc3a85e053678dc0d90126708c4c898bb26664ec01e8457a7570f1258ae949e87712f66d350b58521c4f3e4b9f4918
SSDEEP

49152:CvEVkeeFqw1mnfLehLRi7bdJFsAaoMs7zd+Lw1npXKub7vlYcvupyoNV:qfduGUxJUFs34Kp6ub7vlJvu8I

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2680 7zFM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2680 7zFM.exe
Token: 35 2680 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2680 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RetroNite.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads