eaf4667ec6da80010831e61c49a8035dbf36a94ee99297848d3e673d15de52e5 | Triage

Resubmissions

18/02/2025, 10:45

250218-mteqbszlel 1

01/11/2024, 23:13

241101-27dshsvlht 10

Analysis

max time kernel
771s
max time network
782s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
18/02/2025, 10:45

Sharing

Report Analysis Logs

General

Target

RNSM00390.7z
Size

22.2MB
MD5

be01234d4d2719248cc7bfd2db5399f8
SHA1

30c4a2a41aa45b23d8ea01e547c0e7287b9ba256
SHA256

eaf4667ec6da80010831e61c49a8035dbf36a94ee99297848d3e673d15de52e5
SHA512

71d1fae415f5cb1bedeab41d51f5f8d116f1fa692beaf841e729050482b36647b425a8ac6b0e5ff8d3ad3dbe4d34d8133e06188281be416c9213253d35eaac57
SSDEEP

393216:bKwuR608VMFPJzP7sJSUgNyLNDcqt6/FGuEro0Y912PnhKMZTcc:N0D7sNBNuFfEM4PPoc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
736	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	736	7zFM.exe
Token: 35	736	7zFM.exe
Token: SeSecurityPrivilege	736	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
736	7zFM.exe
736	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00390.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads