Overview
overview
5Static
static
4#Pa$$w0rD_...#$.zip
windows7-x64
1#Pa$$w0rD_...#$.zip
windows10-2004-x64
1#Pa$$w0rD_...p#$.7z
windows7-x64
1#Pa$$w0rD_...p#$.7z
windows10-2004-x64
1Resources/...w.phpt
windows7-x64
3Resources/...w.phpt
windows10-2004-x64
3Resources/...1.phpt
windows7-x64
3Resources/...1.phpt
windows10-2004-x64
3Resources/...8.phpt
windows7-x64
3Resources/...8.phpt
windows10-2004-x64
5Resources/...g.phpt
windows7-x64
3Resources/...g.phpt
windows10-2004-x64
3Resources/...007.js
windows7-x64
3Resources/...007.js
windows10-2004-x64
3Resources/...3.phpt
windows7-x64
3Resources/...3.phpt
windows10-2004-x64
3Resources/...007.js
windows7-x64
3Resources/...007.js
windows10-2004-x64
3Resources/...4.phpt
windows7-x64
3Resources/...4.phpt
windows10-2004-x64
3Resources/...01.ps1
windows7-x64
3Resources/...01.ps1
windows10-2004-x64
3Resources/...oard.h
windows7-x64
3Resources/...oard.h
windows10-2004-x64
3Resources/...6.phpt
windows7-x64
3Resources/...6.phpt
windows10-2004-x64
3Resources/...8.phpt
windows7-x64
3Resources/...8.phpt
windows10-2004-x64
3Resources/...1.phpt
windows7-x64
3Resources/...1.phpt
windows10-2004-x64
3Resources/...6/htwj
windows7-x64
1Resources/...6/htwj
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
124s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
06/01/2025, 08:53
Behavioral task
behavioral1
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Resources/Data/x64/r4_groupH_simple_rpcenc_017w.phpt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Resources/Data/x64/r4_groupH_simple_rpcenc_017w.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Resources/Data/x64/schema041.phpt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Resources/Data/x64/schema041.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Resources/Data/x64/ssa_bug_008.phpt
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
Resources/Data/x64/ssa_bug_008.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Resources/Data/x64/template_cloning.phpt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Resources/Data/x64/template_cloning.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Resources/Data/x64/try_multicatch_007.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Resources/Data/x64/try_multicatch_007.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Resources/Data/x64/x86/T33.phpt
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral16
Sample
Resources/Data/x64/x86/T33.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Resources/Data/x64/x86/bug64007.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Resources/Data/x64/x86/bug64007.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Resources/Data/x64/x86/bug72094.phpt
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
Resources/Data/x64/x86/bug72094.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Resources/Data/x64/x86/foreachLoop.001.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Resources/Data/x64/x86/foreachLoop.001.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Resources/Data/x64/x86/fpm_scoreboard.h
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral24
Sample
Resources/Data/x64/x86/fpm_scoreboard.h
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Resources/Data/x64/x86/frontcontroller16.phpt
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral26
Sample
Resources/Data/x64/x86/frontcontroller16.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Resources/Data/x64/x86/gh12908.phpt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Resources/Data/x64/x86/gh12908.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Resources/Data/x64/x86/gh13991.phpt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Resources/Data/x64/x86/gh13991.phpt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Resources/Data/x64/x86/htwj
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
Resources/Data/x64/x86/htwj
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target #Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
- Size 7.5MB
- Sample250106-ktfaravkfl
- SHA256 bc845ab964ef0e15f09dc27adc16edb3381e9aac924d5787ef0046dbe62347d0
- MD5 b82b154592009655f2431f3c3e8537c2
- SHA1 14a1e65bb14a1c3374b092403fae84514440465c
- SHA512 c6cd3afe1cb5888a96ba0dad7e12f359a8cfeb54a36edbfe3b46784174786a1f9db0cb6c6a219839c011779e619609a766bd5ee1de45ec716299dfeffbec873a
- SSDEEP 196608:jzsg208CQPnTFcwHHXWAF2zVmSEno4zx8:Mb0srHHXWAUs1e
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 7zFM.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 2696 7zFM.exe Token: 35 2696 7zFM.exe Token: SeSecurityPrivilege 2696 7zFM.exe Token: SeSecurityPrivilege 2696 7zFM.exe Token: SeRestorePrivilege 2948 7zG.exe Token: 35 2948 7zG.exe Token: SeSecurityPrivilege 2948 7zG.exe Token: SeSecurityPrivilege 2948 7zG.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2696 7zFM.exe 2696 7zFM.exe 2696 7zFM.exe 2696 7zFM.exe 2948 7zG.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2696
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\" -ad -an -ai#7zMap21197:116:7zEvent193441⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2948
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z
- Size 7.5MB
- SHA256 b5dd13a6ac780c83b108281abc9b05ab60901556770fca27e0074243449d5b12
- MD5 e2e4aa08af81749382abd08bdae9d5ad
- SHA1 3310da15547d8bd20376399e4a5ac9543721500a
- SHA512 96155e7076929f18205804a957a10e72e72717e1cf778a2c9e68ebff34773eafbeb0ae56a5d08e2d0d0ef979f8af9861fc9d976c26235ca4314e277a4ead3d0d
- SSDEEP 196608:Pzsg208CQPnTFcwHHXWAF2zVmSEno4zxg:Yb0srHHXWAUs1u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\Resources\htwj
- Size 2.4MB
- SHA256 6bf12cad0c848c4ff37152c30d263188d07da8c5f17dac4f49c2ba0691221add
- MD5 ceea78710c5247be6a4dda72a209f3d5
- SHA1 92d6cc42c820df8fee42748e1f778d3265cf582a
- SHA512 e2164edb3eee4bbf97aca6da81b1d2cb7b35bd2569d72c8f0a9fdf42738ae83100a399c7c831229706d857a4d4adbd5ea5cf1ab50b7c0feb43954bb9a7f44471
- SSDEEP 49152:0oW77h3ZeJJ1ubXvArL/wmKYXV78GOWF9xY3IEAWF:jsZeJJcvzmdl7vO4E3I9WF
- MD5 SHA1 SHA512 SSDEEP