1252c59f28ed87f9236af0b045978c17351faf34649e639b1dc8fdfdd5ccc0ae | Triage

Analysis

max time kernel
437s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 15:41

Sharing

Report Analysis Logs

General

Target

安装指南/DefenderRemover.zip
Size

505KB
MD5

9e5e97169b6cba4e7b31c698686a673c
SHA1

129a714ae1b81d60aa82b54b6c8569e9ab570787
SHA256

db1b187020ff2c794ac1565cd41baa3425c164aee82608bfebb831a2f997ba29
SHA512

b9a40e2608f67e7f66c57952150b7a8c39007a437943bfcdc9515ef8aaa43e6d1416dea16c06866891921b8904f1dd4ae2f2c0f08c410a3114ec55c878bb1cb9
SSDEEP

12288:n7SDe/kYAhSoTHD9Xa9lovLoS/x790K9KoybuHq6f6diYgyC:n7SqAhS4KQoS/PVQ4HedixyC

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2216 7zFM.exe
Token: 35 2216 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2216 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\安装指南\DefenderRemover.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads