6b6b25eeecfacf2b1877724a4e62b19def35606f1fa573fdeaff26b0d2c12d07 | Triage

Resubmissions

10-12-2024 17:11

241210-vqnsts1kfs 10

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 17:11

Sharing

Report Analysis Logs

General

Target

241210-vlyr8swkfk_pw_infected.zip
Size

30.1MB
MD5

f6b3f89f67d7c06af32b1b4cad98bd34
SHA1

4281e34a36877e07c98b95b860598aab23778425
SHA256

6b6b25eeecfacf2b1877724a4e62b19def35606f1fa573fdeaff26b0d2c12d07
SHA512

f9bd661fa7732de8c9482625855dba934cf73ffabdfbd5089b716488b398d2bcc3a93b9c843ebe70bc5c148c1640218c0c76978f23bf4c375e58c447fee7a949
SSDEEP

786432:9wx9dCtKtAdgrXs8KA049aUAcxQ5GWz4M+:OrG5ws8KATwUAX5E

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2900	7zFM.exe
Token: 35	2900	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\241210-vlyr8swkfk_pw_infected.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads