30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966 | Triage

Resubmissions

02-12-2024 01:25

241202-bszhkaxlfj 7

21-09-2024 21:03

240921-zwgnxstdke 10

21-09-2024 20:29

240921-y9lz5asajd 10

Analysis

max time kernel
1558s
max time network
1561s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 01:25

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

76.2MB
MD5

8dfb6836a04b97fad58393202c9587b6
SHA1

671282ad51b365930cfa4dae262b838669d29b3f
SHA256

9e0751d586fdd328522ad3f84873f8be946d966af52596384af4b4c90b7a0158
SHA512

103dd876fc27d2051dc6b59c364078197f52cfbba996a15b2bfbeddb511114f02a8062574e3a99018036a27ee83dea93ee1b172fa1d81a360096f98caeb7cea5
SSDEEP

1572864:Ee4hJceZcymVkfWx0/sX2ZNt/Ls7fWxZaG2A/oYqb:Ee41t+xy82LtzVxSbf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2080	7zFM.exe
Token: 35	2080	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads