7728801d200d18fb1824faa0199d8eeef78d1bebb74b1c1ec7d6c040b5992dba | Triage

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 08:34

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

74.8MB
MD5

dc8b9e11629b0428d884f11b5aabf7a0
SHA1

37c5d1a15e39aecf185481de12ef3cbf11a1c3f8
SHA256

2f4bb34d0c7a7f2f4fd7d8776fbb74eb7fc543ea555a4c3403d5436d4f6e760d
SHA512

2263d3d8281de36bbb4ba55b11024245917535cdfb28df2c56aacbe0c32266649c9b8c621e90ea74e3b1916ef240b3e873569294214a057518d067b88562176b
SSDEEP

1572864:xJ39Kk9MWTI/m2cB8ceyIS7nqYdd6hIEhSmn6nlN/oFuA:Ik9MWTI/mN/vP7nMhJnUXo0A

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3672	7zFM.exe
Token: 35	3672	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3672	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads