Analysis
-
max time kernel
96s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 13:55
Static task
static1
Behavioral task
behavioral1
Sample
19-12-2024_UqVE2XPvW38Pgkj.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
19-12-2024_UqVE2XPvW38Pgkj.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Bootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
19-12-2024_UqVE2XPvW38Pgkj.zip
-
Size
4.3MB
-
MD5
cf356b163f946dc2f16d95febf45a583
-
SHA1
e7c8e964c23f86765d729b82d3140604bb00cb7c
-
SHA256
50d3bf20e1534889385de4b8d780a750c9d37a75c941ffae6dd961caef2eb325
-
SHA512
baa6367011ebda751fe7ef40a49f99e96c5daf19e068b02b2cdf564477f17a792a9dc0887b9723208d0c49d55a7e1c501723643d12fee8c8dcd0d1406e65be2d
-
SSDEEP
98304:YIv1mD5TqdFfK4iBOqWh3tWyfzbgwgGP7OZlGWwCR6t+uWiPBt1KP:YIdmFkF7iMtWKzkwgh1wc6t+cBS
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1084 7zFM.exe Token: 35 1084 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1084 7zFM.exe