6d11d8339ed8917190ba15dfbdf12c46d0a9d90b4b680edf54a8c65585e76e74 | Triage

Resubmissions

26-11-2024 19:09

241126-xtsx3a1nfj 10

26-11-2024 19:08

241126-xs64asvmcw 7

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 19:09

Sharing

Report Analysis Logs

General

Target

Zorara.zip
Size

498KB
MD5

935eca784190b019bddfcbd9977c9416
SHA1

7dc1869d79a110f7394afe4b93c06b586185139d
SHA256

6d11d8339ed8917190ba15dfbdf12c46d0a9d90b4b680edf54a8c65585e76e74
SHA512

624f2b2348a4ab37855cd238b244d99f9dfdf4cfd7c8bfb2e55ad72aeee161db1d8a9e961e6e31f6be5f52a0f9c0562f49e484dc9763540c7c45ea819a9cdae3
SSDEEP

12288:UmCAJEZ64ZZnv7zOCcf+X/N4mUiRvyPqBmKUU+zSy:Uc4ZZvOPBi5/BmKUBWy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2604	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	2604	7zFM.exe
Token: 35	2604	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
2604	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Zorara.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads