6bf16a7e4243192f646af557655c39a15c45e0f54f4e926630f0dbc02dc95fda | Triage

Resubmissions

29-11-2024 04:20

241129-eyl17s1keq 1

29-11-2024 03:47

241129-ecdgyatkgy 10

Analysis

max time kernel
1561s
max time network
1561s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 04:20

Sharing

Report Analysis Logs

General

Target

PLEASEWORK.rar
Size

32KB
MD5

86117256ec6c1c3431ef95922b4b80e9
SHA1

fafede09d0724b67ac485ae1b071656aac384420
SHA256

6bf16a7e4243192f646af557655c39a15c45e0f54f4e926630f0dbc02dc95fda
SHA512

1d073b501d155d56e18b1d3fb6eea9a6c7038b9ceeaee2ceea586f4611bdb2bd422cf4df2f9eb94f11280c8143ab44bbfd97957752a7c279690c3369ee6f0908
SSDEEP

768:KMcHcEgoHntlhY1jtrK9sZX8pho6IbXjWp1LGbhrK:NctgeSXe9qqo6yZe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
856	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	856	7zFM.exe
Token: 35	856	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PLEASEWORK.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads