b49b89328099bc486bc076e131bd380524bf7efd365629d975a727334fe586e1 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 19:33

Sharing

Report Analysis Logs

General

Target

LoaderX.zip
Size

17.0MB
MD5

e6a995c34bf16ab93c3cabff19166c8b
SHA1

b83b6ec7847e13031ff9f758b1b6339d3fcd77b2
SHA256

b49b89328099bc486bc076e131bd380524bf7efd365629d975a727334fe586e1
SHA512

3abe34df98ad38ed5ba127ae537e31148a85219d4e1ec085b28012af95005ef99d7be45c5ad071714b192ebf1aaee2df144cdcbfb8db05ca9587f134b90087c3
SSDEEP

393216:JMmZnjuJA8Cg4pBeetbsVDoCeSf0sUxlUb4/pKFtz4PquA:aqUA8z4paDleSwdxKDzHuA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1904	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1904	7zFM.exe
Token: 35	1904	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\LoaderX.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads