Overview
overview
10Static
static
3281024afqk...).appx
windows7-x64
281024afqk...).appx
windows10-2004-x64
10PsfLauncher32.exe
windows7-x64
1PsfLauncher32.exe
windows10-2004-x64
3PsfLauncher64.exe
windows7-x64
1PsfLauncher64.exe
windows10-2004-x64
1PsfRunDll32.exe
windows7-x64
1PsfRunDll32.exe
windows10-2004-x64
3PsfRunDll64.exe
windows7-x64
1PsfRunDll64.exe
windows10-2004-x64
1PsfRuntime32.dll
windows7-x64
3PsfRuntime32.dll
windows10-2004-x64
3PsfRuntime64.dll
windows7-x64
1PsfRuntime64.dll
windows10-2004-x64
1StartingSc...er.ps1
windows7-x64
3StartingSc...er.ps1
windows10-2004-x64
3VFS/Progra...13.exe
windows7-x64
3VFS/Progra...13.exe
windows10-2004-x64
3VFS/Progra...za.dll
windows7-x64
3VFS/Progra...za.dll
windows10-2004-x64
3VFS/Progra...xa.dll
windows7-x64
3VFS/Progra...xa.dll
windows10-2004-x64
3VFS/Progra...ar.dll
windows7-x64
3VFS/Progra...ar.dll
windows10-2004-x64
3VFS/Progra...64.dll
windows7-x64
1VFS/Progra...64.dll
windows10-2004-x64
1VFS/Progra...me2.7z
windows7-x64
1VFS/Progra...me2.7z
windows10-2004-x64
1VFS/Progra...ar.dll
windows7-x64
1VFS/Progra...ar.dll
windows10-2004-x64
1VFS/Progra...za.dll
windows7-x64
1VFS/Progra...za.dll
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 04:39
Static task
static1
Behavioral task
behavioral1
Sample
281024afqk0.msix (1).appx
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
281024afqk0.msix (1).appx
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
PsfLauncher32.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
PsfLauncher32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
PsfLauncher64.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PsfLauncher64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
PsfRunDll32.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
PsfRunDll32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
PsfRunDll64.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
PsfRunDll64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
PsfRuntime32.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
PsfRuntime32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
PsfRuntime64.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
PsfRuntime64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
StartingScriptWrapper.ps1
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
StartingScriptWrapper.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
VFS/ProgramFilesX64/13/13.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
VFS/ProgramFilesX64/13/13.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
VFS/ProgramFilesX64/13/7za.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
VFS/ProgramFilesX64/13/7za.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
VFS/ProgramFilesX64/13/7zxa.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
VFS/ProgramFilesX64/13/7zxa.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
VFS/ProgramFilesX64/13/GoogleChrome2.7z
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
VFS/ProgramFilesX64/13/GoogleChrome2.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
VFS/ProgramFilesX64/13/arm64/7za.dll
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
VFS/ProgramFilesX64/13/arm64/7za.dll
Resource
win10v2004-20241007-en
General
-
Target
VFS/ProgramFilesX64/13/GoogleChrome2.7z
-
Size
1.4MB
-
MD5
99732fb703c4d1e51ddabde2c96975e8
-
SHA1
4fbff9403124dc7f5a5c1ae6252c9ffacdb1df72
-
SHA256
3ec04b5c60939209c5d19dd525e53425aef8803d242d9ad63346445ebe09398c
-
SHA512
09bd5f55b25b243d695a4f91f65bd9559f27d122d5da180312d38e83d983d743f8db2a7883aa3550f2efbad7b71510ce87393c89ee0d04c854a957788f96e10d
-
SSDEEP
24576:sPkEzUSYY7iMv1BKENeII6Jz3/A1PIhus8SWQZSGzDQlEpHPCEZD8Bz7zTVw/80C:36Hti7nII6N/v4QZSGzDQlul98Bz7/VP
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7zFM.exedescription pid Process Token: SeRestorePrivilege 5044 7zFM.exe Token: 35 5044 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7zFM.exepid Process 5044 7zFM.exe