cef9230ad3111e4a233e61b49ac977d4d25849061a90b05c3e7d6f308022b4de | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 12:05

Sharing

Report Analysis Logs

General

Target

Rebel.7z
Size

8.1MB
MD5

4a8429dd823216bda95f67f85483a8d9
SHA1

77640784d85848c945820d37794839f346f138d2
SHA256

cef9230ad3111e4a233e61b49ac977d4d25849061a90b05c3e7d6f308022b4de
SHA512

1d4d41cee280c62657b17c2ddc11fc7ce6bab42204d94fe05eed263d139765c19dfd16f2fde4b4e5e8b925c39945c3208600a2bfad941e4723d3bfeb7c30b91a
SSDEEP

196608:15bVwZ4n4D4PLSFpJah2Hc4sEYcGijKseRAKvpZheSaE:155EAWpSt/DcFjqRAKvnhpd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2524	7zFM.exe
Token: 35	2524	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Rebel.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads