Overview
overview
10Static
static
1Mirrored Temp.rar
windows10-ltsc 2021-x64
10Mirrored Temp.rar
windows11-21h2-x64
1Guna.UI2.dll
windows10-ltsc 2021-x64
1Guna.UI2.dll
windows11-21h2-x64
1Mirrored Temp.exe
windows10-ltsc 2021-x64
10Mirrored Temp.exe
windows11-21h2-x64
10loader-o.pyc
windows10-ltsc 2021-x64
3loader-o.pyc
windows11-21h2-x64
3Newtonsoft.Json.dll
windows10-ltsc 2021-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-12-2024 17:59
Static task
static1
Behavioral task
behavioral1
Sample
Mirrored Temp.rar
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
Mirrored Temp.rar
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Mirrored Temp.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
Mirrored Temp.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
loader-o.pyc
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
loader-o.pyc
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Newtonsoft.Json.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral10
Sample
Newtonsoft.Json.dll
Resource
win11-20241007-en
General
-
Target
Mirrored Temp.rar
-
Size
60.7MB
-
MD5
426dbda31c5464395fdbb8c71578b064
-
SHA1
62f451e2c9eb9dac92c05d256c8a91a0fe232a11
-
SHA256
2a62bb02fdeecca8f59e0ed1f6590d6ca2f09487ff6fb1b06731ca620d7b7d25
-
SHA512
0227e67310a81c8c2d46c7cfb671390173e9d300acc0028589029cb3e8179d650d55ca5b8e470293040c6556d194f1a3386633dde9f901e699af9e4e789cbc9d
-
SSDEEP
1572864:9YIpD4rytnGkdPmEBvEULWDZDiEPGQ8r7AKOQU7eG:Cvyp4yVL6uEuQ8nTOv7eG
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4160 7zFM.exe Token: 35 4160 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4160 7zFM.exe