75f2a8d3e1f915b088664823f135721f812dcfa8eb2eb7a43b0bd20c11aff03c | Triage

Resubmissions

21-11-2024 13:39

241121-qx5byasnay 1

21-11-2024 13:36

241121-qwpvvssnas 4

21-11-2024 13:35

241121-qvwl1sxjeq 1

Analysis

max time kernel
42s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 13:35

Sharing

Report Analysis Logs

General

Target

Collapse v3.1.2.rar
Size

52.1MB
MD5

9240354ae1bec81b418ee7c6cbe72e68
SHA1

827d5a93361b86881060535c70fbb089760b781d
SHA256

75f2a8d3e1f915b088664823f135721f812dcfa8eb2eb7a43b0bd20c11aff03c
SHA512

815a0787cf7c4bfcffc43a2d33f593b14a132f1b878353a89c311504dd5488cdc8c4bd5af87b8d9f0226662e81032489f2426b4e398e1f78fcae614612bd9a4a
SSDEEP

1572864:0q9nQW+ztp5RsAzyUTbGcev8eX5FuButjUWU+E:0q9QW+z/hy7EeKBudUWA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2116	7zFM.exe
Token: 35	2116	7zFM.exe
Token: SeSecurityPrivilege	2116	7zFM.exe
Token: SeSecurityPrivilege	2116	7zFM.exe
Token: SeSecurityPrivilege	2116	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2116	7zFM.exe
2116	7zFM.exe
2116	7zFM.exe
2116	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Collapse v3.1.2.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads