aafde59bd18e2ea55967da235f68985cbd0e17cd39ae625fd5fae8ce001a4c4b | Triage

Resubmissions

07-01-2025 15:01

250107-sd8alaxqdq 7

06-01-2025 07:51

250106-jptrxa1kav 10

06-01-2025 07:48

250106-jnl1ns1jgv 5

08-09-2024 17:12

240908-vqwtfazere 7

Analysis

max time kernel
424s
max time network
436s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
06-01-2025 07:48

Sharing

Report Analysis Logs

General

Target

BLTools v2.7.1 [PRO2].zip
Size

13.8MB
MD5

01952f721e3cebff244c689b5cd24756
SHA1

d77afa2071c5487b0cc39243a75e1aaab082975c
SHA256

aafde59bd18e2ea55967da235f68985cbd0e17cd39ae625fd5fae8ce001a4c4b
SHA512

93259ccbd91be6f62fc1b2b0d818773702a2166835dff67eab33ee27537ed452f38e61dcc6651d328d87011fb38cb243aca99ffdc78fa3b66f19fa48ae75fe53
SSDEEP

196608:DCKyX8k4lfzoILWsniW8lnJ45/9iD54+V11bFv4zmkt/P:Gtskkb1LWsnk+h

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3088	7zFM.exe
Token: 35	3088	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3088	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BLTools v2.7.1 [PRO2].zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads