e88e83193cc7752b3fff67082209bc9c2f40351fd5b24cda09fe170c5335619a | Triage

Analysis

max time kernel
141s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/10/2024, 16:44

Sharing

Report Analysis Logs

General

Target

NShаrk.zip
Size

103.5MB
MD5

5ed8758f546ecd41a7dbe294a5ae14e5
SHA1

f8770a55c828efe15083c695ac6cfe2d7f10278b
SHA256

e88e83193cc7752b3fff67082209bc9c2f40351fd5b24cda09fe170c5335619a
SHA512

c03a6dcca6c0ca3b012ec277cdaa16353840145538642edc9edecf175fa6497b932941e3e5101391a3c5d865c6c67ea03583b462ae59761d9b44a979cb9861ee
SSDEEP

3145728:fNazN7yQdY0ZohO/+IxfZlaOpWI36BCvyicYnEu:1oN7yQC0Zp2IJna4WYvxcLu

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	728	7zFM.exe
Token: 35	728	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
728	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NShаrk.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads