55e90e18b443a15116c1102dd21397fd1c7dd1e9aff347e1267c27032e3e4bb3 | Triage

Resubmissions

14-10-2024 14:20

241014-rnpesstcqp 10

12-10-2024 18:58

241012-xmr27azgpp 10

14-06-2023 15:35

230614-s1ralaah8s 10

Analysis

max time kernel
398s
max time network
1597s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2024 18:58

Sharing

Report Analysis Logs

General

Target

All.zip
Size

7.0MB
MD5

2404b782c8a4c1331a548e27e1558ea7
SHA1

d801e6e4dc86758272d2f1c591ee6fe492426145
SHA256

55e90e18b443a15116c1102dd21397fd1c7dd1e9aff347e1267c27032e3e4bb3
SHA512

4c82b0fdf873253a7bbad72e85ada1b569552b755512d727565abb5ec45564a9b7f5a2aae7951dfb97d1aa4cb305c95c3d6e1e3af8c5e1ead244473f624cfbc3
SSDEEP

196608:KT8rFf9o0gtSuOOQA7P5Krz2wqYVde4p0CaOB7:KT8t6ROm7hKrz254p0KB7

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 4424 7zFM.exe
Token: 35 4424 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

4424 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\All.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads