54c847c93bcc25fbb25d341063a1e83d90382a709222915dd2b1b9b972f8919e | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-01-2025 01:31

Sharing

Report Analysis Logs

General

Target

Loader.zip
Size

356KB
MD5

9cdb64fc1bf6d4703410b2acccc3850c
SHA1

398b3598206a36bb455535a8ef753f581d78f8a2
SHA256

54c847c93bcc25fbb25d341063a1e83d90382a709222915dd2b1b9b972f8919e
SHA512

213a2ee4e8d33076c2856df7d2fa976488c57c15d2b5975acd64baaa8a1cea57abd068dde44eec662162e4715aedcb5ac3c288b0864c9345792c763192ba43cc
SSDEEP

6144:84pU5md/QmMJMXGS251HyEEhA26eaTQFPrzjv7iQZpfonR0ehSHpHh:8r5y/pXoXyEx26eaUFjzyQZpi0eYHpHh

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3920	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3920	7zFM.exe
Token: 35	3920	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3920	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Loader.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads