9ee379ee8c7fd876158596597ebdb41a24d6cdbe1e28342c237b70f714c8edfa | Triage

Analysis

max time kernel
1783s
max time network
1153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

extension.zip
Size

52KB
MD5

fb33cd39876530ba1c9be986035bd9b3
SHA1

d0aa1e010848fe3e6f456b1e8987c24b9b9bdcd0
SHA256

06e8ab91d6acbff5285ad9e74b48c86f56a740f02245a85452629970704728ed
SHA512

b343abcce169f1b21f7dd6bc96573dbbaefa6bbb9b426f9b968cd7d6f1e8daf3975bd7df83f45b19ee2f7b2d83027187c4ce1e497e298bedfde07dd58ab828dc
SSDEEP

1536:Swgh3MFPcbHQ6xawE1+3/gsYDw/kQkdncOjCl:SDw6xawE1+vgTPQkdncOOl

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4996	7zFM.exe
Token: 35	4996	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4996	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\extension.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads