d9029d87aae61f32f6ea1f9bace4b63671b89d07ff8173e376d4054078c19669 | Triage

Resubmissions

01-01-2025 20:08

250101-yw3eystrcl 8

01-01-2025 20:04

250101-ytbt8a1qe1 8

01-01-2025 20:01

250101-yrhvra1pgx 8

01-01-2025 14:10

250101-rgpf8axnaw 10

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 20:01

Sharing

Report Analysis Logs

General

Target

DeltaExecutor.zip
Size

8.7MB
MD5

0fe9527ce6a6464c8417949dca101972
SHA1

92e3d746ef23e80ecdee68910b64030bddaa7a9a
SHA256

d9029d87aae61f32f6ea1f9bace4b63671b89d07ff8173e376d4054078c19669
SHA512

39914909702417bfae6e411d2c59acc294961e8a722a87862301f997dcf3ae3a535681045b68e5b79bd970bdae428ca5c1aa33c5115195a919622e6265c6163d
SSDEEP

196608:E0kiwudGHZV4uYmFg7zf2yEC3axVsqFckd1/r81uMRZKI81oeI:EGA56u1G7wCKLzd1/rORZKId

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2328	7zFM.exe
Token: 35	2328	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads