628fa7fe5b5cc0eaa37ac5498d1cd076a4ab0cca0ab74fe1f7bf04df72500fb6 | Triage

Analysis

max time kernel
125s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
25/01/2025, 06:48

Sharing

Report Analysis Logs

General

Target

Wannacry.zip
Size

3.3MB
MD5

56a0968442220c259a99b1b9c0547074
SHA1

2a0eda63252bedecd2a185b5eca3f08c2bf32ae4
SHA256

628fa7fe5b5cc0eaa37ac5498d1cd076a4ab0cca0ab74fe1f7bf04df72500fb6
SHA512

bbac02fde556a8944f6a967ae0f12475283b4d026b0c7401dc8827207975b5a875c36c35078e44c69563a4aebe0497c37dfa80fb81acfcde1f443ef5c2f9653b
SSDEEP

98304:5xNRw5tVkPJ6ya6N+i338RWVSTIldXMVyqop/:FRwPuPJ6y0K30ouyt

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2396	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2396	7zFM.exe
Token: 35	2396	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Wannacry.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads