c2939db0f1eec1145c7b6d6effc192b7f5f1d6e4d3383110ad853449397f109d | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 19:35

Sharing

Report Analysis Logs

General

Target

ElectronV3.zip
Size

37.5MB
MD5

d23729c9d203a5d136f71403cb08623d
SHA1

0e9b5810900923caa88f2cc9d8f101384ccd3c93
SHA256

c2939db0f1eec1145c7b6d6effc192b7f5f1d6e4d3383110ad853449397f109d
SHA512

3166c1561f4991a54e33ee1ee4d63d47fd02ad7c7b338efe58ced086662298b7db18e6ded34d97a07d393165a3c62ab8879b8a30aafb14f462d3e485b2c2919a
SSDEEP

786432:76Q0Xiq6zWRsr1lkFHo93HnQJyQ60ah2onFJ00Xa01cJftEzM9lPaTRk:7tzWOs2FJh2MJT1af6caTRk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
1344	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	1344	7zFM.exe
Token: 35	1344	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
1344	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ElectronV3.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads