f9e5fe3194d9734845dd782b8e41065577ed7628a112934f1a57599f8dd92209 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 23:38

Sharing

Report Analysis Logs

General

Target

Solaraexecutor.zip
Size

30.1MB
MD5

5b96ce8081bb025c4ad8ae12dc91e102
SHA1

8708c3a51d990a437a4fe003c1fe2bc39e2f65cb
SHA256

f9e5fe3194d9734845dd782b8e41065577ed7628a112934f1a57599f8dd92209
SHA512

39a5e646df49f5c45f24e6aa479dfb40302f939383fdad15d6e3d9de7819aac5a2ec5525fad46ead503fe94d97b11fa587aa0448051d78d37ee8f0f6fdaa146a
SSDEEP

786432:3mA77b6IpMM1QvHzoB/h4pUfbRgo0lJBrPCLaBzR8mHl0:X/b6OMM1QvM/4p8R30lju26m6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1524	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1524	7zFM.exe
Token: 35	1524	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1524	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Solaraexecutor.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads