e883775711e2df54fc98181d782ede135d1b5e212594fe59cb9e75be5cdfaaa6 | Triage

Resubmissions

07-01-2025 23:46

250107-3sjkwswnen 10

06-01-2025 21:58

250106-1vmzzszjgs 10

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 21:58

Sharing

Report Analysis Logs

General

Target

installer_1.05_36.9.rar
Size

17.3MB
MD5

19f6ca66f86dd36182837b1e5845e2c7
SHA1

df171122405698b7dd482a41beb1dbd614168fa4
SHA256

11874068ef0e522730f49d405fd2b66fd54bfd692217ba75b53fcfbbe628e47c
SHA512

40319a21e9e3805ec43a63b75b88018eff9e42558743b8592003560d5d21b179cba319252d5398b41d06dd1bdf56bb99db0d77160e35fd56d97b3bdc78f632b1
SSDEEP

393216:VZmphOyRvFL6UdiB5nFxhmRvmJiS7+dMA/bYo6:VZmphOyRtJiBHKR+4MA/Ev

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1792	7zFM.exe
Token: 35	1792	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\installer_1.05_36.9.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads