4c1aaaa61a240058119c50ef4feaeaa8575af2dc8e44a3fa27f2fec30d58b63c | Triage

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:44

Sharing

Report Analysis Logs

General

Target

240521-ycqxtagd4s_pw_infected.zip
Size

17.6MB
MD5

c0555cb8e58cbf5e073ea021f615b4a5
SHA1

c4f65b1848639eccb4a8c43fb55574ec524aaba2
SHA256

4c1aaaa61a240058119c50ef4feaeaa8575af2dc8e44a3fa27f2fec30d58b63c
SHA512

c37186747769ee4d77262a8191bff33dd634fc05266ee1b238830c1a806bdfa480e5f4f843af9b76b9ce9e5b3ac74573109c68f4149fa1f64871f64b40dd9aa7
SSDEEP

393216:xkaKHtUs/mVC9GRHn7oruRozGFk93UuTOYrWddQk:tUzmVcGD2skNCMk

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zG.exe

description pid process

Token: SeRestorePrivilege 700 7zG.exe
Token: 35 700 7zG.exe
Token: SeSecurityPrivilege 700 7zG.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

700 7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\240521-ycqxtagd4s_pw_infected.zip
1⤵
PID:4972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\240521-ycqxtagd4s_pw_infected\" -ad -an -ai#7zMap22176:138:7zEvent16407
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads