Analysis
-
max time kernel
79s -
max time network
84s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
20-01-2025 18:48
General
-
Target
5bc34b9e75a1380367085d62ef91ed7b3d871c0f7dd819b0347be1666a73c576.zip
-
Size
1.8MB
-
MD5
28c44150c697ed313b0eabf9cd38c86c
-
SHA1
31e074a20fdd2e31e1cd311f380361f2cb3ad05b
-
SHA256
82e0ed3cda8146242bfa19fc018d58758598ae58249e2d9175796ef21b5ac381
-
SHA512
49b145f7acbfb033fed26ca49fd4505f2edd74c9216a97bc1268deee1a81d940cc47c323bc94a3857b033f24288975235b28b8479fe9080c6fbd0bb955dee91a
-
SSDEEP
49152:Y3hsEWJVAkZTq49SglXAvbQFuyvVDw9933b11wFmhU5ea:Y3pqn5qASglQvb+uy9s993TKmLa
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 26 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\5bc34b9e75a1380367085d62ef91ed7b3d871c0f7dd819b0347be1666a73c576.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB