a4a7c59d9fef34c1d28ab6fe2633512072c694455af1252ffac0d221bc8aef8d | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 05:21

Sharing

Report Analysis Logs

General

Target

24.9.3 pass is 1.zip
Size

8.6MB
MD5

5b2e26263a34768be4d27555af3c2ebc
SHA1

93ae29885db891ee0b0e02f239e27f341eeb6d4b
SHA256

a4a7c59d9fef34c1d28ab6fe2633512072c694455af1252ffac0d221bc8aef8d
SHA512

c254667787d08bb4254ad7bc2b746f2c33eca22ffbe3dcb5f4c6bf77a3cedfe3e2cb11add8dbe7ed8959791e10f4a86e74efe02bdc50afb5b5b002d46aa448e7
SSDEEP

196608:W/EQJ9M0g36VumYIMhFujmzEOhM5wxp2ueJetCyo+1:W/HCKgd+jSOApy+Cg

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2516 7zFM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2516 7zFM.exe
Token: 35 2516 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2516 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\24.9.3 pass is 1.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads