ba2f01e1b6ebd5e55a11c5164a0b11bde34fe42135d0d81a9c228990abc886a1 | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/01/2025, 15:40

Sharing

Report Analysis Logs

General

Target

DiscordXploit.rar
Size

115KB
MD5

ce7557476eb42db6fd3753dad8db44f0
SHA1

b0095dc373ee2635cdede710178d011e8e7cd76f
SHA256

ba2f01e1b6ebd5e55a11c5164a0b11bde34fe42135d0d81a9c228990abc886a1
SHA512

5f346ebdcefc57b6afdaa393abcdb31c3153919dc54af6c1417fdcdd41200446a6b84fe24b58bf9c0b47788eb3d93faf68b31eb77532059cdeb0f20ac084b7c6
SSDEEP

3072:6hgtxr1GXkkui0nI1nmaWqVR1Yy+VfmbUYz4C1yDotNV:ft91ykkX0omt2AYp1yDi7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1668	7zFM.exe
Token: 35	1668	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DiscordXploit.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads