39df5ebb9e956cec79d11fb54a677fb3e0b62477b583f012b69cb697eb2a00c3 | Triage

Analysis

max time kernel
112s
max time network
16s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04/12/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

maple.rar
Size

69.3MB
MD5

b363d8c2c9b491c9c34a52e0e6af0310
SHA1

dfe10fb5b37990cea349a7ff79c207d4ee1a2f67
SHA256

39df5ebb9e956cec79d11fb54a677fb3e0b62477b583f012b69cb697eb2a00c3
SHA512

63e05d8911c2e7cea491191355fe51390326a3a2c86565ec8e4acb0c942c625e9f808b779476439eecc7f27262db00d4ae8a8bf778891aa70ddf485ee4a806ee
SSDEEP

1572864:Q949aoK4M3asKv8Wj/4K37cHnmoDSmmLh5deSlCVfpu:Q98K4CTQ/4MMX+eSo+

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1672	7zFM.exe
Token: 35	1672	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\maple.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads