e9c35b32ff5f1637e1057d36a26c622dde0744d5004cd55ddf43800196f92e04 | Triage

Analysis

max time kernel
195s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11-10-2024 10:53

Sharing

Report Analysis Logs

General

Target

TradingView_PRO.rar
Size

6.8MB
MD5

c4e366fb7c1875db195b6665d170f16f
SHA1

8d88e33867fa7af02d1fb62a9e698676461e2846
SHA256

e9c35b32ff5f1637e1057d36a26c622dde0744d5004cd55ddf43800196f92e04
SHA512

e229546b1b3b7f845024d5669b60d3a2528f5125273f53aa60ee02a291dc0118eb710e570f27b9502477138311a9d8fc08f21e6673f98d40ad9f98d7ed215dd0
SSDEEP

196608:E71OrLjmS48jWd0ppe14PBgaGAkYDACKbWSx9:UOnSbOpp44PBgaGATGl

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4540	7zFM.exe
Token: 35	4540	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4540	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\TradingView_PRO.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads