ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa | Triage

Resubmissions

02-11-2024 20:29

241102-y9hygatqf1 10

02-11-2024 20:26

241102-y729bsvbqa 1

Analysis

max time kernel
440s
max time network
444s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-11-2024 20:26

Sharing

Report Analysis Logs

General

Target

BadRabbit.zip
Size

393KB
MD5

61da9939db42e2c3007ece3f163e2d06
SHA1

4bd7e9098de61adecc1bdbd1a01490994d1905fb
SHA256

ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa
SHA512

14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e
SSDEEP

12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	3904	7zFM.exe
Token: 35	3904	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
3904	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BadRabbit.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads