8a9d0115b56f9a6a8ed231d3400e1362425e265e5944a0ec0903a70e888ab171 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 19:14

Sharing

Report Analysis Logs

General

Target

Avoid.zip
Size

241KB
MD5

19851e369fc50763189442e3c6694712
SHA1

d2e47f277743f3c4253bc2ce85bb40cc67c87b8f
SHA256

8a9d0115b56f9a6a8ed231d3400e1362425e265e5944a0ec0903a70e888ab171
SHA512

f79ba6f1219f8e10cadc3a4a5c8ab2051affe3b9bf7a4edaed505dd3acddcd57327f6cb1f728e37a74a78d685a9bd244313a629cdffea58a219a7eb4615f31de
SSDEEP

6144:GGI0XrI4z5qS/4YiSA79KR4zc8r8FL7KFKz6wlXhH:pvX0ABd09KqzcZL+FKzHxH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1984	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1984	7zFM.exe
Token: 35	1984	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Avoid.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads