cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d | Triage

Resubmissions

31/12/2024, 21:35

241231-1fmqnszqft 10

31/12/2024, 21:27

241231-1axzfssnek 10

16/12/2024, 05:27

241216-f5kx6awmh1 10

14/12/2024, 20:23

241214-y6jqlasrhy 10

14/12/2024, 20:22

241214-y51bysvmbk 10

14/12/2024, 20:13

241214-yzc98svkfr 10

14/12/2024, 13:14

241214-qgw1masrcy 10

14/12/2024, 13:12

241214-qfk7qsvlaq 3

12/12/2024, 18:19

241212-wymq6ssnat 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2024, 18:16

Sharing

Report Analysis Logs

General

Target

241127-xqsswsslej_pw_infected/Downloaders.zip
Size

12KB
MD5

94fe78dc42e3403d06477f995770733c
SHA1

ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA256

16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
SHA512

add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP

384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4036	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4036	7zFM.exe
Token: 35	4036	7zFM.exe
Token: SeSecurityPrivilege	4036	7zFM.exe
Token: SeSecurityPrivilege	4036	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4036	7zFM.exe
4036	7zFM.exe
4036	7zFM.exe
4036	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\241127-xqsswsslej_pw_infected\Downloaders.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads