bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 01:37

Sharing

Report Analysis Logs

General

Target

lib 0.zip
Size

34KB
MD5

0a76bd3e26768bba68aca3d210997069
SHA1

753690994a18cf58ed0fe3749d16448b763047b8
SHA256

9056b87f079861d1b0f041317d6415927d9ffb6498ce2530ff90fda69fa64e78
SHA512

14408ea7f44bc365a58d7480fff9ea3b10fa21bfbd3363c6e30b74a4d4121677e20ce1108cce12c203f0760768aee1c1aa69b130e090c409f9a516ea02d70c49
SSDEEP

768:ea3asamaSazaYapa+aPanaca9aCajaIal:ea3asamaSazaYapa+aPanaca9aCajaIS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2096	7zFM.exe
Token: 35	2096	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\lib 0.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads