4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 10:25

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/res.zip
Size

162KB
MD5

23e2490706d024bd70ccb906ebf0b62d
SHA1

94c346ac69ff8867204f1a2346491342203980be
SHA256

fbb054f0880b81de92be6a9500c6757f4e1a3e8e335e31821d76b49de8375c8c
SHA512

fdd948396d184cc7e663678ce179721dc5d9ddedceb46110a86acfe4ac69613e36ed4030ece15ef95b575c0027d0e83f0c99f9c1c7fe55b967c86fe4cef86bd0
SSDEEP

3072:xqbNMh58abnJ6taLk0gLP5mAugd+YMfYTY3CtKqnyL3d:zz/d6t+aLP5mAr7MfP3KKbLd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2104	7zFM.exe
Token: 35	2104	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\res.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads