5269e48c323090f07365fbcfb4430419b7f0f41ab5d34021aac32921997deed3 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24/03/2025, 12:42

Sharing

Report Analysis Logs

General

Target

kdmapper.7z
Size

3.5MB
MD5

126845468658d736498b172bda22510a
SHA1

9281027cc8af123f08a58daa5f890c02f9afca02
SHA256

5269e48c323090f07365fbcfb4430419b7f0f41ab5d34021aac32921997deed3
SHA512

e2e4b158bad87d87f4a0c53d266b28a10a27a3f93091c5c6319b7f5e33c9ab458991295f2e5347cde7e316dc4f9f52f00b0690fe71f1f6b0e67c190732bbdc82
SSDEEP

98304:xDe9XhNbK/nDwAnVNC0kgjuc0dipgDcKe/noSc0WIMUz8:x8NO/MWNCsScxpggKe/nkJV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2940	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2940	7zFM.exe
Token: 35	2940	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\kdmapper.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads