Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-01-2025 15:04

General

  • Target

    Collapse.zip

  • Size

    54.3MB

  • MD5

    c9c09a7de133528b18d8687475099f00

  • SHA1

    92efc6c5a138d5631dd113cbc0f501f8e1d6f5c2

  • SHA256

    d94fafd3cbab6f1fc8486ba4f56f21723aa4934e04a8d91e1fec10c5d8fdf67f

  • SHA512

    d8a2eded28250713e55475258c769156300ff5770c28ae447690ed4fbe33ababf2972577f67c9d0f09ad55811f16e439d89789238be56992068f18e44bc7957e

  • SSDEEP

    1572864:YHEcPNHBrThiiGaNh7YQU44tu/Thr2hL4Yyqxb:YH7FVThZNVYn4euQF47qV

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Collapse.zip"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2296
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2116

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Collapse\cfg\resources\hi.pak

      Filesize

      787KB

      MD5

      1185163466551aacae45329c93e92a91

      SHA1

      0dcbfed274934991966ce666d6d941cfe8366323

      SHA256

      eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5

      SHA512

      6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606

    • C:\Users\Admin\AppData\Local\Temp\Collapse\library\test\isfile.txt

      Filesize

      7B

      MD5

      260ca9dd8a4577fc00b7bd5810298076

      SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

      SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

      SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7