ddc4ee5b164774a9bcbc42636ae1b555c0e652943f89809adfe17643739c09d9 | Triage

Resubmissions

07-01-2025 01:39

250107-b213raxqbx 10

06-01-2025 23:51

250106-3wa3xstmfx 10

06-01-2025 23:43

250106-3qm6asvrbr 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 01:39

Sharing

Report Analysis Logs

General

Target

skibidibi.zip
Size

15.0MB
MD5

e3c095bad1b222b74dfab35fce9b58fc
SHA1

dafa30f20bfabe025c446186c3051e713559b635
SHA256

ddc4ee5b164774a9bcbc42636ae1b555c0e652943f89809adfe17643739c09d9
SHA512

509ef669bacb93d494e0df57ca3e5ec3d371815a58ed5c68d445bc2feba57588f6ad0a30efd4cc0894c1c63f4761a422897825021280d2ddbcd40428f5cecfbb
SSDEEP

393216:oWXzo7MYwJONnGHVWx55TbJDnJ6YrNDseN3zGASyC3FzeV8Qic1k:nDokMqWD5TdbJ6YrNrzd1ABeVqc1k

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2844	7zFM.exe
Token: 35	2844	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\skibidibi.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads