fdfba94118a83e52142821d091e2bba6bca54d18521745c3ee4ae8b9d1de5ddd | Triage

Analysis

max time kernel
1368s
max time network
1432s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-11-2024 00:39

Sharing

Report Analysis Logs

General

Target

slinky.rar
Size

78.1MB
MD5

a8f7758fef3de9737d2f87c21a49369c
SHA1

e6e9668543f9b8d841ae3ba829b3ef23fc930f24
SHA256

fdfba94118a83e52142821d091e2bba6bca54d18521745c3ee4ae8b9d1de5ddd
SHA512

a6cf00026e11c656ae2ccb0e19ba575c1f255916116137334a7db1e63271472fabd2346dbff304d93c3b100a661dbb9f3ad188c71d35d2ed23d538de8e881ea3
SSDEEP

1572864:+LN64E+B4WDiHnbLj5CxXrD2Nz4+FT5sX5XXTnKhGOt3KmftOZTa9:+Lw+BdDgjKXfa4I5sJnzKTtHtwe9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2088	7zFM.exe
Token: 35	2088	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\slinky.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads