c265f04f075e27e91611d7e88119823702801684bf39e48ca5c0a2232f994ece | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/03/2025, 19:14

Sharing

Report Analysis Logs

General

Target

Sorillus.rar
Size

69.9MB
MD5

a4a28906274f2395009d7e36f8c3e032
SHA1

f09131c0175774adc141d0f02b923288efb95e10
SHA256

c265f04f075e27e91611d7e88119823702801684bf39e48ca5c0a2232f994ece
SHA512

efbabc19bec15249d26af7c0c90d242a715984440f96ac6a24b21d4773a1ac909039897054e576841eff313c6c580af00d435a25ce1b1becf562311ccac7df8c
SSDEEP

1572864:hyC3saUVoVhrBWwDskPfUuuRWh0BFnRdKfSmPa3EbDv3:Q8saU2VBbQjzRWh0TyLy3Ef

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1972	7zFM.exe
Token: 35	1972	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Sorillus.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads