7e8219c969672aaf670f5847fcd3c8aa42e3d481ed13a27bcd26055c17f74c79 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 20:22

Sharing

Report Analysis Logs

General

Target

dist.rar
Size

27.3MB
MD5

096d8971d7821411f9a366a20674dbf4
SHA1

8671530e2945e2196667cf7ad4db54724123f84a
SHA256

7e8219c969672aaf670f5847fcd3c8aa42e3d481ed13a27bcd26055c17f74c79
SHA512

d651a538a3b12333f6494216fef7b19212392439f78aed836287eb347886284b55cd9e0eb6b8c4770e7914e46209c4ac60e36c01c1992e70e3184e3da32d3936
SSDEEP

786432:3sP/XzQKtQ79ZbnVT07wcgBNBIeATADnvdoIGlkoWhd/np:36/sKcnnV0Ucg3lDvmDehdx

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2168	7zFM.exe
Token: 35	2168	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\dist.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads