04cf383bf7d4e2f3e23c162f56c46b8f1728a57e53b28f47c9eb2280a45fdec4 | Triage

Resubmissions

19-12-2024 14:59

241219-scr7zsvmej 1

19-12-2024 14:40

241219-r2be4avlgj 10

Analysis

max time kernel
49s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 14:59

Sharing

Report Analysis Logs

General

Target

boot_fps_v2.rar
Size

20.1MB
MD5

2be5d8faf40ced85b24204da86425cfd
SHA1

649e935ea6e27357558dc8c079cf3cb28a724ee5
SHA256

04cf383bf7d4e2f3e23c162f56c46b8f1728a57e53b28f47c9eb2280a45fdec4
SHA512

56fda3890457cafd6773c549472610e21f9803284d9d2f1e9dfd2cd043b124675680e47526b80526c77583b3d86cc0d7e6c37f4f92dd2b7a1bba0983650da802
SSDEEP

393216:P2WD2NrtrFEm3bqn4fXuqvxKiHFkzadFewtRG6a6LQbZJ5a:VDmZlCrqJU2fHpLeZJo

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1916	7zFM.exe
Token: 35	1916	7zFM.exe
Token: SeSecurityPrivilege	1916	7zFM.exe
Token: SeSecurityPrivilege	1916	7zFM.exe
Token: SeSecurityPrivilege	1916	7zFM.exe
Token: SeSecurityPrivilege	1916	7zFM.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1916	7zFM.exe
1916	7zFM.exe
1916	7zFM.exe
1916	7zFM.exe
1916	7zFM.exe
1916	7zFM.exe
1916	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\boot_fps_v2.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads