5e9a3b7c09b846141c577674b503cd048a286467af96cb22039c3eb6044c581f | Triage

Analysis

max time kernel
19s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 19:30

Sharing

Report Analysis Logs

General

Target

CapCut.zip
Size

135.5MB
MD5

6e321ebba238492692fd68e3cd0e546b
SHA1

c240b9c144629b7f5e86f6f9ffe0c0c764e2fd3a
SHA256

5e9a3b7c09b846141c577674b503cd048a286467af96cb22039c3eb6044c581f
SHA512

577ba6f5dbc7eff2ba9cc5eb19673cfb668af7d4ed18d7ec48b83469aed08565ccf3067ad94a2aae1ee52deb30220f09447bec4842f3435a64d89caf32fbf872
SSDEEP

3145728:daGpsJ12+1ynnBj522dHUDvZ3zYGr8osEl9ZLwY0x+J9:bps2yABdpyR3psE5Lha+

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3004	7zFM.exe
Token: 35	3004	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CapCut.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads