b662290de96c568fc32720e4862e8eb5da8bc47096c8b66599d51072a5db4ae8 | Triage

Resubmissions

20/02/2025, 14:15

250220-rkw1gawran 10

Analysis

max time kernel
787s
max time network
450s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
20/02/2025, 14:15

Sharing

Report Analysis Logs

General

Target

Velocity (1).7z
Size

280.9MB
MD5

ddd76a3c9d42e64261a6369463305779
SHA1

3edcae24eaab3fe14e4a6a84937ebb9733fa1eac
SHA256

b662290de96c568fc32720e4862e8eb5da8bc47096c8b66599d51072a5db4ae8
SHA512

c6e4a8f86c40401941330219c620160955f3d1b1efecfa7e3f70c77b85204af10beb76d0d2cbb4840e1b890ddf6d48173db9c9112411fd286795acb73f9110cb
SSDEEP

6291456:hEa5oguevRaJwacAbRiXZvuo0j7nNh9kEC7cQ13VC29a0Ic/:WarRa2acDZwj7NhmECzCkJ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3868	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3868	7zFM.exe
Token: 35	3868	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3868	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Velocity (1).7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads