348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861 | Triage

Resubmissions

26/03/2025, 16:44

250326-t9brya1ls3 10

26/03/2025, 16:43

250326-t8ahgsyxbv 10

Analysis

max time kernel
30s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 16:43

Sharing

Report Analysis Logs

General

Target

Loader.rar
Size

7.5MB
MD5

7d67a76a8354226bdef759e77559ef4b
SHA1

ce16e1d54a98f40f627d59fcad6731d4d1c7848e
SHA256

348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861
SHA512

f6ab8dc861ac5a9c5f6970e747e13b3feba4bf78ea5aed9e0d9e0aba671a1ecc2fcf10ea878ce224794888231d9c4d9d32bc799975be7d4520e009300935e4a4
SSDEEP

196608:zg5D7Sn0mxSg0AWelXnsQs8uks0CCw8dipUHFIS87:zg5D203ghXnq1X0/daGIS87

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2920	7zFM.exe
Token: 35	2920	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Loader.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads