7396387cd5bebdafed26cb32d52ea4c780b08e8bb358db7b20e743448391e016 | Triage

Resubmissions

25/02/2025, 16:58

250225-vhcetsxpx3 1

21/01/2025, 19:12

250121-xwkpgaxqfr 10

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 19:12

Sharing

Report Analysis Logs

General

Target

Loader.zip
Size

156.3MB
MD5

07c25292f2c72370b9798591d0ec42a7
SHA1

7262e0214d8266f234a8db925900ba46b4fec8ff
SHA256

7396387cd5bebdafed26cb32d52ea4c780b08e8bb358db7b20e743448391e016
SHA512

f5cccb9a3f663fd168d1242845a7d32d720c7671d2e2efc253e601b53878445c7f3504a416394c32c9d83469a409a631253c8a9a75ddefefaf7ef57bc8115066
SSDEEP

3145728:5SjEVsBz/OLgeHkmeZDldmQj+0ixyCcsVLpsGnH7GTslm:5Sj3DOLZDeZDl0A1sHcsTtnwkm

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2840	7zFM.exe
Token: 35	2840	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Loader.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads