3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3 | Triage

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 15:59

Sharing

Report Analysis Logs

General

Target

OrcusRAT-main.zip
Size

25.0MB
MD5

4ebe8621171038676189cbc5e7053d9f
SHA1

2e3a3b97163d1e8af1e41c36f9495062fb4b1934
SHA256

3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3
SHA512

e0091ae9f3acddc7e8d11b89a60debc3dab57b8af57bde4a3f538b2283eae398a1adec8224bf5fd2d0be61be015fc2a79c49b06cf786945073e1cc87d66be356
SSDEEP

786432:DFrAoo07VJxiSdlBx4IVwXuOHKW3kijZk:hrA+xJBgIEuMUiNk

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2772 7zFM.exe
Token: 35 2772 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2772 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OrcusRAT-main.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads