Analysis
-
max time kernel
35s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 16:51
Behavioral task
behavioral1
Sample
scun.7z
Resource
win10v2004-20250314-en
General
-
Target
scun.7z
-
Size
12.3MB
-
MD5
fcfa0444f6a3e09ea4963b0613b389e0
-
SHA1
085aac1f9aa1f009ae93247628a5b556142353e6
-
SHA256
9d55cf770b9034ed95656645e62dc3837435ced8d9bffaa91c50f88a5169032d
-
SHA512
5a27236809b6a642b46c59bd78a4d77c8c84b6ab672a68a6d2206124fe4241afbf6a28587fbda892a6778abf3892026d148226f46df44d9b433ec4d4db7d3552
-
SSDEEP
393216:5arLCprQX+0bN59yKKWbnTdJoB/WLH/NyBt:YrLCpQN55IKrbnTbY2c
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4840 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe -
Loads dropped DLL 7 IoCs
pid Process 3724 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe 3724 AddonsynthesisGtTS.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024248-4.dat pyinstaller -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2068 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2068 7zFM.exe Token: 35 2068 7zFM.exe Token: SeSecurityPrivilege 2068 7zFM.exe Token: SeSecurityPrivilege 2068 7zFM.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2068 7zFM.exe 2068 7zFM.exe 2068 7zFM.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4840 wrote to memory of 3724 4840 AddonsynthesisGtTS.exe 102 PID 4840 wrote to memory of 3724 4840 AddonsynthesisGtTS.exe 102
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\scun.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2068
-
C:\Users\Admin\Desktop\AddonsynthesisGtTS.exe"C:\Users\Admin\Desktop\AddonsynthesisGtTS.exe" C:\Users\Admin\Desktop\animatedlava.gif1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\Desktop\AddonsynthesisGtTS.exe"C:\Users\Admin\Desktop\AddonsynthesisGtTS.exe" C:\Users\Admin\Desktop\animatedlava.gif2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3724
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4120
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5dc83cb57b9cabcb1e19650e7a82697de
SHA1f62d681c02c48453ae03733b830c05020f6ba971
SHA256f82bd3cf95e02749ff1adff76725e3645e17c2780954bd724ed63ef6827633f5
SHA51254ab930f2309a87e956a7a59a14fb50e16f8d341809e368c0817b9ea54f81b12d96e6975df81b54dfc0ae1372dd7798a1150cf8a62980168727f04d844a50d43
-
Filesize
520KB
MD5d5625adb3503ee8d85777f1467e3827d
SHA17f696bb84d998c1b2da74a394356c5250e59d180
SHA25683207c4d4ff7ffbbb90b2498e39557e80eaac2956f0bebb9433ce9301461f5ff
SHA5129f1ad5812dbe7439bf426c8b32aa6cf81146d503f4561d852c11b71077ee2073a7e98acdfb04eab0efba8891f6bdb6e817b342929b8985ac534ebffdab402c95
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
82KB
MD53859239ced9a45399b967ebce5a6ba23
SHA16f8ff3df90ac833c1eb69208db462cda8ca3f8d6
SHA256a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
SHA512030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69
-
Filesize
247KB
MD565b4ab77d6c6231c145d3e20e7073f51
SHA123d5ce68ed6aa8eaabe3366d2dd04e89d248328e
SHA25693eb9d1859edca1c29594491863bf3d72af70b9a4240e0d9dd171f668f4f8614
SHA51228023446e5ac90e9e618673c879ca46f598a62fbb9e69ef925db334ad9cb1544916caf81e2ecdc26b75964dcedba4ad4de1ba2c42fb838d0df504d963fcf17ee
-
Filesize
155KB
MD5e5abc3a72996f8fde0bcf709e6577d9d
SHA115770bdcd06e171f0b868c803b8cf33a8581edd3
SHA2561796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
SHA512b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6
-
Filesize
1.8MB
MD5e17ce7183e682de459eec1a5ac9cbbff
SHA1722968ca6eb123730ebc30ff2d498f9a5dad4cc1
SHA256ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d
SHA512fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
Filesize
8.3MB
MD5a621d63c8f10501e7629dd69e07d3cb8
SHA1871cf1ebe98187aa5d899a3c875ab39ea40a48c9
SHA256f70302e7e3744a9983ddab40d6b3ed4af212dedc5029ae1bce53cb8aed81afa1
SHA512c71d0dc2288225cbc2c629d4e0b0e6716b86008f458ec2881450b6fdca5eebb46e4c234f27f1b641bda53887c6baadb56749ec3127dd5e9c9b9e2a00e31b9c4d
-
Filesize
4.2MB
MD5005ae56e839fb59d23f73a97f4970355
SHA1dc798abb902e9e94223c4e4c12d56c1580f2c16c
SHA256f4622ada74d975541e9a8d9260fc24882a8fe80f11e734761bd0d7968fba8e35
SHA5120ef1a52ad187bc0c06606fe0c6428da04d02ec164854a3caf94bd0383ecb1833b5d676c97d32ee5b1223dc6e5231aa65dd078307b3d022a66827b96956f8700d
-
Filesize
256KB
MD5c876754f08bb44939bc10232b5ca2fd5
SHA159dbc6b46e3d4840bddf0f6a675eaf64a54b04e4
SHA25663b6efcd0e34e2ce7dc7abcaf4eee4f5f78c449fc8a7d09d883b126395559e88
SHA512636e24dff93702ac819cb641b5cd76eaac2177bfe644145fab18c490201af20a8806bbecb52cbc70c1e5798a347b402bdc2a57cb890ad38ea1bafdfc61ae1a0f
-
Filesize
768KB
MD53e1f1d66100c7cdf1539d5da9f56adc9
SHA1cfa185599a11ce164ccc1e70d8791edad985a904
SHA25643faf64a90b8e8c9d5e8c354b213940c1d0bfc2df86fdb1b8c945b9ee23c027e
SHA5129a62e8385afa01c7bb4ecd5f78c410447e9197443496f6de0aa483971d04d6dcdac72974f10945d35f47c0bacca5c107ca5bf614e8f5439e98f0d5f1414c85e1
-
Filesize
768KB
MD5f92506fe550657fbbfc510e5aff4852e
SHA1f5daef1c618f645d07e95c6002b3866bdd3fe903
SHA2565227c26911dab07f8363e46cf3570f9d9f807de4497f89f87ec24b62d2ce732c
SHA512eea64705c1ad0bf034130a547dab0b303cc244f9b89151d9c26c35268bf68ec64c30e9c2379ec3bb6d616a2b08cbfd72bbaba38958b1a217f7a7beaa45a00421
-
Filesize
768KB
MD5fa150101ab2918076124f4d1131e4bf1
SHA13b8c8921f3afa7ea427cabb261e7e4a187a3eb44
SHA25658a271a20b3ceb9b0e4d476c835fc7ac5a502e7800330df819d52cda421f2890
SHA512eb3650f48cbba529bf0beb08fbbf2d5f3fcc5c4df27a13bc8f31481613dceabce1a7bf644b3ab077b73ef3ddbb7004de00daa0690478279784c8ce5f7a3d3b2c
-
Filesize
768KB
MD528e038b9732bdaed323d0ba4379266c5
SHA189fc24ab44a5cb562710765f33f2905fa75ecb41
SHA256756e94b23991d8c7965e8cc8271a51f21f325a165883f57df15f902b13018c44
SHA5126ac3795e46efdb84f375435f02e541fe1b3fdd26f5d1bc520a03fa2f5c385caea04da0cc35659e24ddc87fa62cb21db6652770769175a45d5bdebc633fc3bf7a
-
Filesize
768KB
MD58441930f75330e6bab89c3d180c2e0a9
SHA1ca929cae72b962a8d7a6299ddb05b192c1531e2b
SHA256d5ed4140feb0085ffc11f16b41845d6811c89bb60c268da2e6af4a09eb50fe69
SHA512f38487d93dd09c1938b2cf649a6481abe26a0d18fd1165bbf8a3dc53c65cd0e3c0f93e8c74c3041716344b664dfae88c359b55ae8098144c951a178b4c7260b9
-
Filesize
768KB
MD544741465a9852d95ac0d69f2c56ae242
SHA132af46483a854a00ec189d845333ccc9d5d187e0
SHA25670fe3b5bc257134c53b8f6de3a6c0903616c32d8c38ef5d4afa15ed6ee61e42d
SHA512598b5eed7832c7fd65c0702cc7cb615438688d99128a989c3e7c4bf8d9404f8da8faf5d3a47995215393b6b232bd1fcd3a19f8db2d33235b4dda3093cef772ee
-
Filesize
768KB
MD5cc95293d772b02fbf4869230e14e095f
SHA1d803cd1f74c7404bd50b71644b8877c83cd429c1
SHA256ff63c156563ec0fec655f52eece0091e0c2123cd5e404b79330f7c0c585fdb32
SHA512540ffa95292302afcfeccab136dab39d16271c2f7b39cd1afaab4718e6268877d5e8bf2717345f2e374065f4234252262cfa04de801e8e259b10c2f931c07a61
-
Filesize
768KB
MD5efc27a84f9e766324496f6e2a3354274
SHA17ed2829fe86810f94117b182623e256b7a669f2e
SHA2562f532bbdd1866c660c582a8e6c888e8b866bc92e13d8f60fc0d3c2ad5a58da4e
SHA512c2b1cd11828d309359e09478dd2a2c8199789841e4ca6790b877cc55e195e287d46044d1b00aefdb509cfde3fb2131baee8080c3d581afa052c841082397b21f
-
Filesize
768KB
MD5da845c5039846bf8d79ed293fad78fe0
SHA1c9787758106235908207fe9516d5e0a00a8904b9
SHA2561cd01be2dbbe701e3c2b9acb6ebaeba2af1944200aa1c2f7319fa1207544daf5
SHA512fc401203ff0398ba2313c9adf2a94480f124a955138bbb20e29f492294de0d503c9dba3e6df4f3100905223bc41248600e397a78ad9775b186bf9d6eb1c361c2
-
Filesize
768KB
MD586c78f4e66a43bbde1a4081a9afdf75e
SHA1340dd8dcea8564530dbd069d3050791cc59e4b29
SHA256224b44f97e02b10868828532cca56782583769e4bbfaba2da07ba3fe6b94a823
SHA512a23aeacb9d1f8de3de98dce3e41a6375a604eec3798f9971416cf44f74f72d975cc19c14975d92f42514e325ea35082747094e164e5445818ba2ed67b7207f38
-
Filesize
768KB
MD529e78184be9b7c9264051f8ea78562d4
SHA1430a5162d57a38ac589f6ee9513ad8ea3b06d441
SHA2567cb59063e897c97d438fca064caf037244bb950dd00d7a766b411b71e85de405
SHA512d2ad7bbfcfeea85245206c568dd36d89d9a1b70d72bd9551571efb928835842110053323c7624a2b4575c7477d5ecf51ae49f22db953fdc8b03f2ebbc53c4483
-
Filesize
768KB
MD54880b96ada656ca7514ca73dfe6539f8
SHA14f148a6ff182157bd6519a24f8e933bd1165ec93
SHA256a5d0df89b4cfb861c1e890a2ae4055463b73600cc5d9f1ca90a470fd29253b95
SHA512745355e0c56311fa52093dea081f8f6160280d0fac7e40b531b79de2cddc5fb93fbf9d8a4f1e3e82894241ddaee43fe37fd8ee5d1b2f68ff58aad2775036670f
-
Filesize
768KB
MD529ac6cb6ae8d76947462b1115e81afe4
SHA1ba6de5b2b1cf68be6a0403e6272b465b967df0a2
SHA25673a645898601c925ebca0b3d513729a06be893ad15aa74eacfbdfb27d74d3e50
SHA512506fc3df02ef157e415f966513dac6e17c48a639cfde4de84f30c706f78e92e22cb127e2662a14736b3a213ec6155b9c9de800a2743d6b03750352dab0dc2ebc
-
Filesize
768KB
MD5a9f7fa4f9ae8a4ef635775cdb0030c9e
SHA1a959e226552cf1b0fe820257d65a0bb0958737a5
SHA256b6e27b5b9de1432bb824c755292b4a8bd32f0a498b8762122548ca266b8b4f86
SHA512379c7e9517b09efe439f66044ffbfd44b01c2b161e81e4ba5d16470f9601fc98a9d6953f4e0314e548bde09b02175c40e82ed3207801f0c6ff72e3c891df19a9
-
Filesize
768KB
MD58b33099974ebd89371180845371c673f
SHA1591061997731c2c6f35d530c34a2b585557aa341
SHA256b19c627284a36fe1f1e70204c5aa69ad3e51d28c0d6a82b05549c48a0ecea308
SHA512a7ba7a7c2ee6945fa148199fec5d80a7d2f845752bc30da4ae13faa2dc9a4b5fd51d8bd7d7fd68bb23fdf71a29a230fc9e0168e0cd72d145a1b4aeb9e78e42c8
-
Filesize
768KB
MD57f0192d651a4c56de798d7b5b9fcd14b
SHA1f47ef780ac6d0e9f975ae30853aed19631d5b026
SHA2567707db47d20fb38159bb77eab24d4e8aa5b6a1e1ee2ef7d632888bafd8e544ad
SHA512845fd39674a4e395e2e736538f320a802927699a2b604d324439b0e19c2698a83a6fa2e1f34e8a54fef7181ccfb04fbe46cf6a97ff161080b63f61903e411040
-
Filesize
768KB
MD54412a5119507fe3fa67afe5544140cd1
SHA13aefd77a8c68290d6e326a4e9aff05e83c7eec76
SHA25610f029a91f52c6814208cfa3557032de06c6ec9ba4e0cb71c373cf56229a64f6
SHA51274eb6df64c23ffc89689e132fd37713723d52f1c62e189d418464490d6d5cd46538b9803369d290deee4dd13fee6d36ad49b649b4257e110d921272e1801a722
-
Filesize
768KB
MD5318f0e0613df52c6ef5a3558659e5fd8
SHA1beb92e0e3e73b6d32b10293f7a991d1e76ba9835
SHA256b0b9d03a581b6f513218f48bcf7285d8888ce0e23578ad1822c4e657012d1c9c
SHA512352849ff8347dfaaf2cfa2f30d1c9ecc4253fb77acbae7d1b9c7a1f6a41610412824b0c2b84c97ab59e80e5c997a3e0729303fd1a31bb1f3d3fb11aea6a8eabb
-
Filesize
768KB
MD57ddebbbdf618e6774b1d562ce3675fa8
SHA1f8dff301865806a3d81ebceb964449fee66a616b
SHA25655c8ae57b95fbc8a09b9ea0488e2a59597c8434c9067c9a2532fef7210f48952
SHA5126b125678e65f98eb647b92fb21c00c79bc0eba461da7d152bd80afd9cfd045942df5bc72c1adfe231920a48043aaa41b3f351f08980b4526c5636c7b4f63851d
-
Filesize
768KB
MD57868d5d937926bcaa57714b222d0c6f9
SHA1c5b33781f78240400e4b432438265a27b23ff73c
SHA25620a438cc5b5a38fb5f54df9c60b5cf7e265ed9153713816501f585b23ab5b4be
SHA512b32227cf072294820f66a56d064879785dcda30c3f38ca8a2c73f14a2b88b58954a34ed4cfbcfe7dda732cb158d2d26f3588464625e73636f425126e207eab31
-
Filesize
768KB
MD5aa3d2e5c29ad491ec0e1c34acdfaa8d7
SHA1164ecde9898c01d70e84e9bf00288ba86c945b41
SHA25600a88363c4e3f2b94b44e7e67b59db51ffaa2249b4f5d6027bc578f1111e53ca
SHA5120ca3fe188c616d7fe26b13b86c1e70aaf2670295ee52985044fcf3181ab6dcc801d263cf0ef7176144d350076e7022e83dd7874d539f44ffb5432d2cd63dfde0
-
Filesize
768KB
MD57b9287fbb33badc8c1984d4d425fe8e6
SHA191392efdcd1f41a2255317b11defc4f5a9c3519e
SHA256ac7efbbede3771ca234078398c050bdf366e552c3961d975a3eee3bfca245421
SHA512187522daae8cd5c7704ac4f0929478ac5e3807ecaa34cfeafede7a381067489a7b7030b91359e12f56ce5e8327467bc8c930417a049f76eb76c9635aca3601db
-
Filesize
768KB
MD51b4a3c8a31fe7ecee6ba74da71b75777
SHA18c4db12dc4fff3bfc8f976c6a0ed1beeef55d9c1
SHA2562ba5beb72aa4a39cf4c297f05b451d3e2aa125725c874056e1604aaae41b359e
SHA5122e578cc29b3ddaa11ad8e0da7b86e92cf45ce8c86028f8ca1de8d79357734bea09e50c1da072f8238ea8ff257f6c6ef211fb82bfe3bbbcd03d1668292127ca4b
-
Filesize
768KB
MD5dc60e07a3a50285c84504f8552875c99
SHA1313fccd521b8c94ada8f07752149f1d801230ea6
SHA256d70d70c745ac0a2df05dbc8d0702bc3947bb81f527878ae699d3bfa4e646bd4d
SHA512b7e4a38c9c9e04715a7bc85455945b5cd2d2680dfbb2015aee686c9df2384a3d13c26af1466ef27db9deeb4c7ec30ab224ac2b59134c15410b27a51eaf0c37e1
-
Filesize
768KB
MD5e496e805f414e4a479b8c3355d94441c
SHA1767c0a6eee2e7723ff39cf8347ac6cbeea9b5737
SHA256b8b9165370f310e321683e40bf06f3156b1c093aff956b0b335b58a893a91349
SHA5120fb1606ea4c8a838ef8c572b07eaaeca39fd25fa840271bca309ac47c1282f4a1446af94b69d0dfdb17436ad589c29baed0dd42df4076c071038d44f2ec17f6a
-
Filesize
768KB
MD5efadcb3ea7d1ae18e249037ef0b92c7d
SHA15432e00713a27a963ac2348f6898d280a40bcf46
SHA25630f09e5e022e5caa1a2b9c5af7de361dfc530b3d9ea67620f86d2019c1d6ff4c
SHA512cf3a020f394461d949bdc858382dcc5332064183dea53022db32c7510c71f25be694f446f276766fc55b8e60699b9aa3b45552fade2768a657697b4bd7720d75
-
Filesize
768KB
MD52e7a6a5a5c991074eed77553801f45ef
SHA1ad0df7b98225d38b6159b99aec49c685cdc29851
SHA256eff9f00beb903ce7cc5df01eb7f948cfc7fb20e6575f14c6eb4d74ebc5dafb94
SHA51237d05dc320cce6498427bfe111510aebb308c0f3a0612f4b4f4b953f27673bb854b4b1dc876dd9684395db26214f4938c9fb59db9bed8dfc06cb769d6f78c2a6
-
Filesize
768KB
MD5ad2396a3b214fb1ac14b94c034588511
SHA16d31b5c155a656373d53f94138cfe5c8accd337e
SHA256a40350279fd9348a51460bbeeaa1703d33538b0eb5aa240ae09bf3e9c7c02629
SHA5120b58ba502850e1020bc4ebcbed897ab8e6977318326681e5f1f287e10cce17179df8db39fbbbec69ffc2fe36871f76603abc4714845573dba4ce144c202d5efd
-
Filesize
768KB
MD54d674ed08ba52e96cf034c217c3eed66
SHA12c5db64ab82c3d368ca613784352d335d4a647bf
SHA256bb0bf91979400cbe639a5e7b36236c8979717ef6ca43071c91b94679fc54de11
SHA512ab22057baad53e061af1e11270cb491ad22cfe8665bb5cc0704b7a779c36ea9c9db157fb87ea8016c45c8313a75c81ffb4c0af6c6b43168fe51664856f98d85d
-
Filesize
768KB
MD54b71b17d005971541d5e27c07a59c69b
SHA18e4f46a8507513249ff2b5bb4e47872fde42e680
SHA25621ddab9c04334f61ca7142f85c8cffe82f412de5bc9497c4e234f53837d57f44
SHA51299befa0265690baa7432e349c43c32d7541a11fb19aa1469db761d85e22f1815358ea52ed44eecde32af471ac49f1eca401d825b501975ac92b7e742db00ca0a
-
Filesize
768KB
MD5548a292e337314795e8b68e437e16ab9
SHA17d00a76fe4df6177b4c5229fad2235e5944c27ec
SHA2568d20df12f2289770d8050f060ac8db95f6fe4560ae5bfab9008a662dc510ea37
SHA51294cacd00661539deda1ccbd0b4e61ac1613f064ae0904c32eb9add2bb32ca1a9da92332726536db8f6df2cc4f17afb652075931eb786f6404e3345da20533683