3f0aa24c90dbe0ef9a695236b99dd02b51f8c44a83d3ab490a09577e1a9a74dc | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 08:21

Sharing

Report Analysis Logs

General

Target

Debug.zip
Size

57.0MB
MD5

15bdb40346ff9a47a75370457117a2e9
SHA1

ebe296a8fae5cf76d4f0555b0b18ff9740aa983b
SHA256

3f0aa24c90dbe0ef9a695236b99dd02b51f8c44a83d3ab490a09577e1a9a74dc
SHA512

766cac1ddb392f67cc0d9d4ba8fb4719b8895d59775e32b9c215b83cd7f3f9a2673257fe50a42995622bca348d10d47f3aea1940e682321df8adcad428012f72
SSDEEP

1572864:KcAHw9DccPnFJT9hVPkuPIpI8gqEEsP9ZjsVjS4CRiGnia2716TW:Kc1IqZhhdQpOlEsPbIEiGiU6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1796	7zFM.exe
Token: 35	1796	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Debug.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads