934b98909d53f6571dc3a5c357fbbb8a8e9fb5af46b3c77f11a9f6abcceafb38 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 14:50

Sharing

Report Analysis Logs

General

Target

Insomnia_(password_2222).zip
Size

160.8MB
MD5

fb98ddcf0332d27b4a1dc15941d901e4
SHA1

4a5430446cf40e53d9a9454fcf907d5be5c6d5a1
SHA256

160de07984d221a3ca822fbee04a330d4a74f3ea60702fd41fa44b947b6213f0
SHA512

453def6746c56b3602a901b18c29526d34d00ba55923915ebccfcdfe6f82a0ffd6b2d3dc1b05660bf040157cc6e8500d201a04f2d7b8f55a291e28e72d4797e4
SSDEEP

3145728:uxMyQ4J0jZE0hYM8S0M+BVUdlIwjgQJV7Bw/3SnWN:KZJWyC8bJBVEuQD43Wk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2916	7zFM.exe
Token: 35	2916	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Insomnia_(password_2222).zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads