6a0ac5a6cef15e181e0808a20033f12af37c0ab5d80d6eba62ca3c98b430a740 | Triage

Analysis

max time kernel
146s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-10-2024 14:49

Sharing

Report Analysis Logs

General

Target

r2r-4421.rar
Size

11.0MB
MD5

616260085d7ff006524fd19f98beed84
SHA1

251c8aac64c13f5310b795c73457626408e464c0
SHA256

8cc10f5ca6f42e1fe8ea8c8e3475a5cd6e732b3dd3c1f01df9da4fb495f99ff9
SHA512

7044e991715b019ada33b5a7d483dd8bc3cd2b55e75e576bcefd1f59be1c04ddaea08dcdf3aa501bf1e2089b077a6fef4fad46781fa5a5a1ddd8e75b9735bef5
SSDEEP

196608:DUL2sfe3L4hBb4G+Bw56jy6ZF/wA4SUc2mXlZvhaqa2qJhg2pSBp2gIfb:M2sSL4hBbf16KA4SdV3akw6Sb

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4456	7zFM.exe
Token: 35	4456	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4456	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\r2r-4421.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads