Analysis
-
max time kernel
12s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2025 15:30
Static task
static1
Behavioral task
behavioral1
Sample
cryptic_executor.7z
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cryptic_executor.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
appFile.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
appFile.exe
Resource
win10v2004-20241007-en
General
-
Target
cryptic_executor.7z
-
Size
17.4MB
-
MD5
51d89c40c01b2837263657140aa2d8c9
-
SHA1
7ad04309646a00121e2e761c3258f345a9992853
-
SHA256
34919eb3375d7137817c42914e712baef9a239d6be80ed7a7e58e5b2b1874a29
-
SHA512
e593e5817cbf82073d192edc4a033c3729b9d7407d1f6a554d6542b97105fa3bd8cf2dc2c94db10d429134a85c326ed826faa7a0ce1a8b0d977d483535379192
-
SSDEEP
393216:iGenzqGCz38SYTKLjJHEHKYl1dkVNAC5sV38HLBnTA5CZknyi0rK:pKO1FYII1dkVN9uVMRTAs2IG
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5012 7zFM.exe Token: 35 5012 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5012 7zFM.exe