b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71 | Triage

Resubmissions

24/02/2025, 20:57

250224-zrl3vavqs5 10

12/10/2024, 18:55

241012-xk1asazfrj 10

30/11/2023, 19:32

231130-x8zddshb2y 10

28/06/2021, 11:05

210628-3vdg7sx13e 3

Analysis

max time kernel
1698s
max time network
1140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 18:55

Sharing

Report Analysis Logs

General

Target

31.214.157.40_#[email protected]
Size

7.1MB
MD5

bb1570ca408cf76448102c7ecbbe322c
SHA1

0445c648174ca1930c2cdb0b89902cd4e984a9ea
SHA256

b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71
SHA512

53efbbd752d2b0dd1e13231bf8d917a5ac512962860f6ac46f76d6fb618b4a83a54cabdee5295b20805bbd6a9ce343ff2967257679419185ede4b4ab45294a3f
SSDEEP

196608:qLcWN3KlidmQtekNXjglGHglGKglG05Pu0uCET7+y:MNxJHgKgBgtM1+y

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4348	7zFM.exe
Token: 35	4348	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4348	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#[email protected]"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads