aa5b7367b2b86a3b6e6847a7b168d153e1267c84da8e60b7c9a92a5dfb504fe4 | Triage

Analysis

max time kernel
64s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 15:24

Sharing

Report Analysis Logs

General

Target

AMDupeExploit.rar
Size

6.7MB
MD5

6a082af24d420bdcc6f63c23fb641589
SHA1

4aefd2b3432f052336d2716fa5881304cbcd68a2
SHA256

aa5b7367b2b86a3b6e6847a7b168d153e1267c84da8e60b7c9a92a5dfb504fe4
SHA512

ab0018b9b00e57a7ec8db9d4d734cc9d4e3de2814b8ef6559acb1fb0fad540a62a179ac50d368a1a58d05653dc4499bb4c7578b8b2b9b84de5f9b22277d252c0
SSDEEP

196608:T8591bzyr9dtk9k5ADOWgimO1iw9YcH3b1XjUXAH:T859JWr9PkmlWgTSmcH3BjUY

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3512	7zFM.exe
Token: 35	3512	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3512	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AMDupeExploit.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads