b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71 | Triage

Resubmissions

12-10-2024 18:55

241012-xk1asazfrj 10

30-11-2023 19:32

231130-x8zddshb2y 10

28-06-2021 11:05

210628-3vdg7sx13e 3

Analysis

max time kernel
1698s
max time network
1140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 18:55

Sharing

Report Analysis Logs

General

Target

31.214.157.40_#[email protected]
Size

7.1MB
MD5

bb1570ca408cf76448102c7ecbbe322c
SHA1

0445c648174ca1930c2cdb0b89902cd4e984a9ea
SHA256

b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71
SHA512

53efbbd752d2b0dd1e13231bf8d917a5ac512962860f6ac46f76d6fb618b4a83a54cabdee5295b20805bbd6a9ce343ff2967257679419185ede4b4ab45294a3f
SSDEEP

196608:qLcWN3KlidmQtekNXjglGHglGKglG05Pu0uCET7+y:MNxJHgKgBgtM1+y

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	4348	7zFM.exe
Token: 35	4348	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
4348	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#[email protected]"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads