Analysis
-
max time kernel
132s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 18:56
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
124.8MB
-
MD5
c61b76303dec629b71f15a25a83f2c0f
-
SHA1
cc435c20a428f27139c12b09fe32ab6314a831d1
-
SHA256
a27475a8cdf816ae3fc5ccff8c1b7d6284e24b98580d06dc658fc39ba7d43192
-
SHA512
57646e6e151e7cabb90fc33e37a49a80a61683d2d52da5385f6a882e8d74c0a7f0972cbd04162e40d0490bb4962598fce7bdb741a30f26157fa20c4c8f24b68d
-
SSDEEP
3145728:FJksvYuBMJZy/JYSyAPgdg3ib33ohJH69WfKNZLZM+tp85zR7:3keEZy/JYSyANib33ovaNZL059
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7zO8C8A1CF8\Wave.exe"C:\Users\Admin\AppData\Local\Temp\7zO8C8A1CF8\Wave.exe"2⤵
- Executes dropped EXE
-