70330c357e3752604f59bfd661478bd6d8d114dde53e48b1ad13396adfec346b | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/03/2025, 16:44

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

102.0MB
MD5

0a6c656cb0c0e78ed325babd304409cc
SHA1

366e38c262b6a418546aabe8b9cde030419434e0
SHA256

efbd575c57021b5480dbb27bba6f3cf6e6b008b44638016adc121801fd8f615a
SHA512

7abf6d44c6cc31cc4ac0963c46ac1f6a6cfcb0742ae351821e2af3d04573083b4c9b75f23091c9509e3f45346bf6d05fd24267e271cee6708c03d37435ba3100
SSDEEP

3145728:fw4Mlb52h3yslb52h3yikWOvEVlDOZB931nMhAnvr8g6V:fw9t52hJt52hQWOJZB93lcAnQV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3068	7zFM.exe
Token: 35	3068	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads