12053a39feabd429dedc85c58cf8e8bf7b58136683ec043d85a318094116f92e | Triage

Analysis

max time kernel
361s
max time network
362s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 02:44

Sharing

Report Analysis Logs

General

Target

launcher.zip
Size

13.4MB
MD5

0d09102590621fdc32d7bdbd302a9e3f
SHA1

4cf577548b6575ff84aeca8a0e9e9a6ced76f4ec
SHA256

12053a39feabd429dedc85c58cf8e8bf7b58136683ec043d85a318094116f92e
SHA512

0da119520a3138c780d524309eb856413240f2a27bb424c50cebf1db0da5995a1051f70aac04efd5f4555566180e2acee4e25c40c7e812f5a409186b5fcdf8da
SSDEEP

393216:S+d6IiKvpP7FcCzeGno8/8Ms9jdwWJ4ThPVfA:nIIiMuY1no8kaAaPVY

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 1292 7zFM.exe
Token: 35 1292 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

1292 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\launcher.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads