b9c1b9b0080c47159b024c8cdabeac604e66aeec4022a89b120300290ae4a733 | Triage

Analysis

max time kernel
87s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 19:11

Sharing

Report Analysis Logs

General

Target

Solara.zip
Size

24.8MB
MD5

e3807f3833cd320cb2091fd12a6591dc
SHA1

ea1965d309acc06e982ca11097ddae756da364ca
SHA256

c4f5ad942a7ca909ccbda1053494a426e155e4c5d6422ce384724c95eced4d44
SHA512

5e2568bbe10ab623cc7e896133635d30df745e0d654889e7779edfc38a9ed40b51f348d8fcd4c874336efd5405ca4cc506335e7d4458998f277ea7b979d8c333
SSDEEP

786432:3zVPgXm96ziTA5+DPYWA6mjuPei9z2eXcGQ7:3zV0mEziE5+be6mjti/cV7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2636	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	2636	7zFM.exe
Token: 35	2636	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
2636	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Solara.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads