Analysis
-
max time kernel
16s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
01-01-2025 07:53
General
-
Target
Mods Manager MR-208-1-3-1735435045.zip
-
Size
11.0MB
-
MD5
c68117666fe93995a48c3f9ce5c89ef2
-
SHA1
7637f2118d86460120ebb4d4184bac0c0812e510
-
SHA256
96647169ccc0d8eb18abf345112cf71cef8b0b4768c908be73ca5f4653f110c1
-
SHA512
a70645d3f4f23f59b7598dea61d10982d803dc423ffe0f9ea090a4a0b81412c49b671914b7d3c01b832fd250f1852d3986064680d3f5a7ce282704bc17a38bfd
-
SSDEEP
196608:hncBqo7vYVA2WvRpwDg/40DUAH80J6ZP2p72jF7TYHtN5yTGyXaH2GdmcMbu:BcBqmwVARRUg/4PY+P3F7TYD5nyXu2up
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mods Manager MR-208-1-3-1735435045.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO032D9E97\marvel_rivals_mod_manager.exe"C:\Users\Admin\AppData\Local\Temp\7zO032D9E97\marvel_rivals_mod_manager.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5603c42fd7215987feb880bb5af375eee
SHA14804cd97ce430286559f0e9acfddb7eb0cd061c2
SHA2562cec9a0e9ebd1e8cea5fae5c3a2681aa0eac8e19e568b1ae02d036b6363bb7fd
SHA51231224fc7d7d9cfc63ac2ae9c34f4134fa99d2a7e638ee3b045ff4eebb0b4d2cf96ea1611625ff78a23aa34fb22fb5f3833fb1fa14c49f712c4acebe71be3340f