3aae124eceda655dd6298323abad2fd571cdf580a22ba11921c2d0b45038f406 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 13:05

Sharing

Report Analysis Logs

General

Target

PO PRF-TR-2023-0001.rar
Size

414KB
MD5

8cb7794f3dac113b046d69bc37c08d65
SHA1

19491c29709fa699c75aad9e1522a50366395f2e
SHA256

3aae124eceda655dd6298323abad2fd571cdf580a22ba11921c2d0b45038f406
SHA512

e814f5402df258b2dd6c0e5d792a4efceff2a0b6fe6223d3529fea2f01e875e4b158eac54421b060fc4d6b7ed3520b89830e2bb182ef33e24255f53c8b60f7b9
SSDEEP

12288:6K/31MvR8TVO93usG80Q+55Jkn1YeczzGqThAEXmo5nWu:P31MJX3nGXQ+NaYtNln2o5h

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4760	7zFM.exe
Token: 35	4760	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4760	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PO PRF-TR-2023-0001.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads