f4e3d73eac0f751a9d519e5a8eaff679837413c069a8f0a614d2792d899e44c3 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 14:11

Sharing

Report Analysis Logs

General

Target

Setup.zip
Size

74.8MB
MD5

e874d098f773b601430b0f76a0148eab
SHA1

4873d7d73500323342a3cc0a94107ab52585ffd7
SHA256

f4e3d73eac0f751a9d519e5a8eaff679837413c069a8f0a614d2792d899e44c3
SHA512

ebe031951937cca71f24788399a22a14d800727161c9d52cc70e6104faa24e836ecc3a5951afabeb2c2c9ce2aa1fa15917ef7f43449b3682288cebe4011aa221
SSDEEP

1572864:HdHhu/c91wW7MJh9+XigReAs1g/HvYEyGLKPa0iHDP0:HxgS1nCh9+yydveGLmiHL0

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 4504 7zFM.exe
Token: 35 4504 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

4504 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Setup.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads