4ee66020bf8fd5606f1fa1835a6c2328aab1556035e44a2de60b87c8f8571375 | Triage

Analysis

max time kernel
15s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 11:47

Sharing

Report Analysis Logs

General

Target

tri.rar
Size

17.5MB
MD5

48fd699e9cba54f5c9fb09a3d362aedf
SHA1

f130049b001902d7fcad58f13d6b47f0d055acca
SHA256

4ee66020bf8fd5606f1fa1835a6c2328aab1556035e44a2de60b87c8f8571375
SHA512

7e80794fb6d765ef42236c4fa16a53f817df2a163e944a31513344c1d74379a1ca5df02eafd188294c65b39c47db7d748c30de58ae95693bf161216bcb67e6a8
SSDEEP

393216:1vAMSV/Hy1IrjMr8wyVQvm21KpM1pfWbQVjxm3rYR:1oPyOkwBCpK6WsVtm3rC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2100	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	2100	7zFM.exe
Token: 35	2100	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
2100	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\tri.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads