4fa514f740bcb278e791ecc107bf00d93187ba6f786c536e45a169fec3adf6df | Triage

Resubmissions

30-12-2024 12:39

241230-pvv5tavqfk 1

29-12-2024 14:22

241229-rpt2nstlds 7

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 12:39

Sharing

Report Analysis Logs

General

Target

d6cfefa7-237b-4217-8010-6f9588855a4e.zip
Size

199KB
MD5

344c82765d58b46452c8f72e67b440c8
SHA1

e8df9b7dd60138a7b4dfcd2863aeaa14fda49d81
SHA256

4fa514f740bcb278e791ecc107bf00d93187ba6f786c536e45a169fec3adf6df
SHA512

5f8f85341c0c7fa68fdceb3f9bfecb561d28701470e7840476fd6eca40e78136674f05a0ddf9af38990a918762980407d32e907d12864e3e0044029ffb633774
SSDEEP

6144:bP9K1s6D6MR9HllToJh/17PlJJOpwIp3H:bP9K17WEZoJN1jJO+g

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1644	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1644	7zFM.exe
Token: 35	1644	7zFM.exe
Token: SeSecurityPrivilege	1644	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1644	7zFM.exe
1644	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6cfefa7-237b-4217-8010-6f9588855a4e.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads