51d11e5deb2407945ef5e75ada802ad960ca172c1006aef6336c3c305cc0d8ec | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 14:07

Sharing

Report Analysis Logs

General

Target

ATM CLONING @Accorto_xD.zip
Size

54.1MB
MD5

96ad5e5c30b20897055d47a30362885c
SHA1

772bd9ff34f8e6d6d93d05c5d8a61e6bfd563f42
SHA256

51d11e5deb2407945ef5e75ada802ad960ca172c1006aef6336c3c305cc0d8ec
SHA512

aea489d51e389d67432dee8bb548c69b77466c922d8752175dd27b2779bc3a970ac6bbb7f9b40afd2680e99827be4fc690af7d6a6c3a843d4610e4c9d56de457
SSDEEP

1572864:nRQfiJNYvLFHXbF2UgekPKtduzf+KZLld5/a/:aiJNuBXbFVg/PjLLldla/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2772	7zFM.exe
Token: 35	2772	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ATM CLONING @Accorto_xD.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads