a058ba972382482df87b97f8a2bbe2d0179231c1d24e9ebb86bbc144a0546e7d | Triage

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 17:37

Sharing

Report Analysis Logs

General

Target

Fake Exodus.zip
Size

64.1MB
MD5

b07022b51057e5400b93f90da9dbee96
SHA1

14192724f78b0aff9d06fd0f6994e98bd5e2b851
SHA256

a058ba972382482df87b97f8a2bbe2d0179231c1d24e9ebb86bbc144a0546e7d
SHA512

713bd45e3f3a4bf24ceb1936eab2ac7bc495064b2bc122764f47da13959bf9f8a9b5288086507b769be32fb6d80c7a58876a6d55ad1fa24a7202ddc62b67e819
SSDEEP

1572864:O+o6npjQKxDP53fqSNfAUqqb6J3zM7SO8qynHo0j4za7KA:O+o6nTSUbvp8tnIVa7h

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2772	7zFM.exe
Token: 35	2772	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Fake Exodus.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads