9f3a43ab58c24e5394021009092be2d3ecff413aa57a440542e3b2a827fd9b54 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 21:10

Sharing

Report Analysis Logs

General

Target

snap.78N1BA9-1.200421.144153.gz
Size

10.5MB
MD5

54aa5e777f8f73bb7cb8daea5cfb99bf
SHA1

c17dad826b937467d9027e2400b0fa8d35027330
SHA256

ff6cec14a3024dc65c256e802f7144f8e1dc545a9f1b8a9000c429793a5cac3d
SHA512

a1a11d293d3e92368184080c070dae0c470c0f041e32a9c02954649429d49f60e78e6d0e6c52ad67763919c7cf9e61be51cc4add7881731f1fb0b34d0cc4bb4e
SSDEEP

196608:DY036ZN7m+i93kJhxupRCknB/eIQYFJWv:NA55Juao3QYFJs

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
1556	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	1556	7zFM.exe
Token: 35	1556	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
1556	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\snap.78N1BA9-1.200421.144153.gz"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads