558909412427b05911a02cddfe00fc5e9d30bc38e1ba636d04aa7efb63438ec8 | Triage

Analysis

max time kernel
688s
max time network
1148s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-11-2024 03:47

Sharing

Report Analysis Logs

General

Target

Project Buu.rar
Size

30KB
MD5

92873d2f99e985d47885123508f96de8
SHA1

622e60c7bc942e6a003a7131c35cfe6ccff6d683
SHA256

558909412427b05911a02cddfe00fc5e9d30bc38e1ba636d04aa7efb63438ec8
SHA512

81f0f373c89af6599c511c4e5b5446353bf6b71ce34bb1e6c13d4b3c842e889b505484689c4e800c05dadbf20c54b6d9d5653bf41ae58b6b380b354b1e278dfe
SSDEEP

768:JbQLvR3dqVDOkV406ur3n2N/MCiII7F+2H4:JbQLBnd0xL2vIQb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2876 7zFM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2876 7zFM.exe
Token: 35 2876 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2876 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Project Buu.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads