b878bfc5791ec1039c16b2e81e465fe511e04619f1952f1b34c4d5a28d3eb60d | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 18:49

Sharing

Report Analysis Logs

General

Target

Source Leak.zip
Size

39.6MB
MD5

e64b8344b70fecd613395cdf888698ae
SHA1

543c6c5297febf627a28be183adfb500012bb00a
SHA256

b878bfc5791ec1039c16b2e81e465fe511e04619f1952f1b34c4d5a28d3eb60d
SHA512

3b65d816dbd64aeef3d8627c6b22239adfd21a91bbfa327d76e48057d0a8503cda0bf9dd946ddaab389f5d078f68292970c0447c0dd1c3c9ab0fafad50e7bfff
SSDEEP

786432:Q8f8EgLU6Dc11xD8ZEs69KZZg2pK0BWvcErSde6No8Xpt:Q8EEggPBW8AgeKagcmSrNF

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2720	7zFM.exe
Token: 35	2720	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Source Leak.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads