Overview
overview
10Static
static
30PENM3.zip
windows10-2004-x64
10PENM3.zip
windows10-ltsc 2021-x64
10PENM3.zip
windows11-21h2-x64
1Bootstrapper.exe
windows10-2004-x64
10Bootstrapper.exe
windows10-ltsc 2021-x64
10Bootstrapper.exe
windows11-21h2-x64
3README.txt
windows10-2004-x64
1README.txt
windows10-ltsc 2021-x64
1README.txt
windows11-21h2-x64
3Analysis
-
max time kernel
98s -
max time network
138s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
11-01-2025 23:10
Static task
static1
Behavioral task
behavioral1
Sample
0PENM3.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
0PENM3.zip
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral3
Sample
0PENM3.zip
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Bootstrapper.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral6
Sample
Bootstrapper.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
README.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
README.txt
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral9
Sample
README.txt
Resource
win11-20241007-en
General
-
Target
0PENM3.zip
-
Size
395KB
-
MD5
fb629efa3a1184aae2d334548a7ee618
-
SHA1
a973981a4ec954dd75db4b834d9be1d113bfd529
-
SHA256
27db561f7a41c969d70754f289166d07f0fab55b7f5395adfdc003ad9ca30966
-
SHA512
0ec47fc7976212b0cc1f19670f667693b94a938ac6cbc096a45503cb72f9b37bd1c84424c08bb2e211ad72091b2b81ae8de291cc7485245af3ef73484dfc1857
-
SSDEEP
6144:kidYohZStSB2YIL5e9omn1Zx/FxeB7IXmEEN7nXnp1jBuIeTIumOdZ8Pr+I7AN6O:HYPtACL541ZDwB7IXU5x6IumZ37Amze
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1996 7zFM.exe Token: 35 1996 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 7zFM.exe