0e150f62793e6e0f17368d556a994ea1955db91d80dbc79c0ce22a3e80b52ab8 | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 16:56

Sharing

Report Analysis Logs

General

Target

meow (1).rar
Size

17.7MB
MD5

7473797760ece39e3dbb2cb4d0a65e98
SHA1

4ca60b6dbef1c9c325baa36aa14b6bdb855c9f2d
SHA256

0e150f62793e6e0f17368d556a994ea1955db91d80dbc79c0ce22a3e80b52ab8
SHA512

2f0550894300dcdd9516528310a09b4c70ab1f21616c66bac21ac4328f130b6830204d6a88c01364338b3361f545b213a781dc343730d2d6ada89c190e606f06
SSDEEP

393216:VtoJpW2RaM/Kp4+W6B+j/1nXPkNBRx1csjxEooAA7VmCtHug/lgL2Xce:jxA/Kp1FojapvWoovVTH75

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	4564	7zFM.exe
Token: 35	4564	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
4564	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\meow (1).rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads