b08b16fefd49c0780b9d875455ebd57d69e4c38a9bc0fd3d22fddf1decd8613e | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 14:04

Sharing

Report Analysis Logs

General

Target

Last_Update.zip
Size

115.1MB
MD5

b77f2704c0b2d688d8d261ba9529ebe4
SHA1

da100b659aa3c02468ff48a1417e168e4fc5513f
SHA256

83cb8837a462f00a5d0e8327ff13c70eaa1f500d16dadacbdad79c7f21691c01
SHA512

d78154c6e09e789c98c1a29ff55aafbbc49f6baf77b5a1f220b48cf85f5603e1175d0c9f6ceb00598b7d49bd896b0202521e80f1349a3cdea2abd9375f26941d
SSDEEP

3145728:PEZRDJf7jLrjWKrpbT9XmdBCohjY/J2JCiC2ZKbKIsFfsfgSw6:PEZRhWKrZx+hjSJF2s25NsISN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2420	7zFM.exe
Token: 35	2420	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Last_Update.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads