4b33219c5cadb4d741044874f6f0184d45f43891d28ad5b489716d4da21310fd | Triage

Analysis

max time kernel
206s
max time network
162s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 03:42

Sharing

Report Analysis Logs

General

Target

IOC.zip
Size

1.4MB
MD5

f1b00142524ba8a4ddc691388a5020fb
SHA1

eaabba82a1c6689eb07ff4629daed8bc153fe42d
SHA256

4b33219c5cadb4d741044874f6f0184d45f43891d28ad5b489716d4da21310fd
SHA512

97ef7b89461a18a09adb5de37605e385c7bb5a2143f6df5b413747f78517fe032632adac51ddbe35b6904a7a306eabc1bfe67474a2cdf16e633c73b0bd0e9570
SSDEEP

24576:+Rjjcd4pTEcRst4DRCFT2+Ob902gk6OesN9yWHnBgqKErnV5y/u/0t2O:+1TTEcRsGRmT2NgnKN9fHiErnV5y/M0b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2128 7zFM.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

7zFM.exeAUDIODG.EXE

description	pid	process
Token: SeRestorePrivilege	2128	7zFM.exe
Token: 35	2128	7zFM.exe
Token: SeSecurityPrivilege	2128	7zFM.exe
Token: SeSecurityPrivilege	2128	7zFM.exe
Token: 33	2004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2004	AUDIODG.EXE
Token: 33	2004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2004	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

7zFM.exe

pid process

2128 7zFM.exe
2128 7zFM.exe
2128 7zFM.exe
2128 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\IOC.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2128

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads