c5a936b546d48b39e1fbc7f535ea25d7e969889d0a3b6b860fb71a3576e04419 | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/10/2024, 17:18

Sharing

Report Analysis Logs

General

Target

Vape.rar
Size

2.5MB
MD5

f293cddf279b713755e7112f489536c2
SHA1

5b99ba528002fa724e3248d33a2f67488f5e9d68
SHA256

c5a936b546d48b39e1fbc7f535ea25d7e969889d0a3b6b860fb71a3576e04419
SHA512

a6f1402a63ef36342d802def82c4da1efe15818cc0f8437c0558c8c7ed26a2b31e586f069beab6559fd697affdf156b8617e3fd093f3aafe42ef513c28ee94ce
SSDEEP

49152:pAkSY6gUGWjW0Uu9hgx/zWafAZjqTAJc7Z2:pH6g3WKCafAfJn

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2356	7zFM.exe
Token: 35	2356	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Vape.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads