Analysis
-
max time kernel
424s -
max time network
426s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 22:12
General
-
Target
installer_1.05_36.9.zip
-
Size
20.8MB
-
MD5
e866021c606a52158525d4f2df67a5cd
-
SHA1
bdb711c91b37bcf9306d53c396441eab5d0f4fbc
-
SHA256
e883775711e2df54fc98181d782ede135d1b5e212594fe59cb9e75be5cdfaaa6
-
SHA512
61432fdd6a5a7744ed37359cbe98786981fed6fc32795179267a571904323ea69c500b3c2cb5bd2c6572d34c212ed9bb1c1d9e5a73c5e27d95d8c8989ea7f569
-
SSDEEP
393216:NZmphOyRvFL6UdiB5nFxhmRvmJiS7+dMA/bYomtmx6YDjN1fxRS:NZmphOyRtJiBHKR+4MA/EpQvPxQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\installer_1.05_36.9.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\New folder\" -an -ai#7zMap439:118:7zEvent150171⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\New folder\winrar-x64.exe"C:\Users\Admin\Desktop\New folder\winrar-x64.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.3MB
MD519f6ca66f86dd36182837b1e5845e2c7
SHA1df171122405698b7dd482a41beb1dbd614168fa4
SHA25611874068ef0e522730f49d405fd2b66fd54bfd692217ba75b53fcfbbe628e47c
SHA51240319a21e9e3805ec43a63b75b88018eff9e42558743b8592003560d5d21b179cba319252d5398b41d06dd1bdf56bb99db0d77160e35fd56d97b3bdc78f632b1
-
Filesize
3.6MB
MD5517023aad9ad2f3200057ce0b704e196
SHA17612058b5f0f87327b2957d5da63a2c6e65b0ea1
SHA256de1d9040786c80f3f40f41c98aa1f6b14fc7b6f2d3db09eceadd340327164f8e
SHA512bef1b7268d8c2c1f6c900fe392ecf11d2cd518dfa9944fb77c29c2306d20d89052a39c45d689054173ce866be1e93d4b3097131a120cd7567092527e1f50b3e1