98c7ed12a9c8f8c8c4b321fe8b1f0111387961c365a2e053a2a13414cd53a2e0 | Triage

Analysis

max time kernel
72s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 02:27

Sharing

Report Analysis Logs

General

Target

Setup.zip
Size

126.7MB
MD5

307e7ca23242f65e49887e5455723410
SHA1

834501fda42e01480a23a2894491b7e49ae43c5f
SHA256

98c7ed12a9c8f8c8c4b321fe8b1f0111387961c365a2e053a2a13414cd53a2e0
SHA512

de97238b2a2b41e32241246a59befa9b3b92cb0e5146386cdab845809fe43be2bb6c42eba15db61eadec72c393a915b711998aa7e96333f3cec50ff56ddd9811
SSDEEP

3145728:PHBH4iP9KG0LJz4RESbbveTg4rG50sTMHO3lzgW:pHxVK3LJCDGg4rGnMIV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2460	7zFM.exe
Token: 35	2460	7zFM.exe
Token: SeSecurityPrivilege	2460	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2460	7zFM.exe
2460	7zFM.exe
2460	7zFM.exe
2460	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Setup.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads