065f3e527b8e8046efc92f372c60c9e9cc0feb5970e8a45a45e81f9828030d81 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/03/2025, 09:39

Sharing

Report Analysis Logs

General

Target

sample.tar
Size

26.5MB
MD5

d5b764f2ddf85fe4a089af2f16209333
SHA1

964ec577bd3f5fc79069da22cf9d386c86e4b27c
SHA256

179dd7b87af25d7ef942078ac4addbdd76fc7090efaffb247a17042fc19304d3
SHA512

08ee13da3943890360c1ff8624aa122d3f14912bc9925022b50b2dffc02d6f6fda56220a797c0ac8282111ccc6b72f2721dd2bcc72bc03fa8c093a550f3b4fde
SSDEEP

393216:I0g7qgdd75sRNP+cOU6Xh4MVqt3qiDzhBICfVDbLAga3:IwgddlsRN2cOU8VGz7xVPLAg8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1728	7zFM.exe
Token: 35	1728	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads