c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809 | Triage

Resubmissions

09/11/2024, 22:49

241109-2r2veatfrl 10

09/11/2024, 22:47

241109-2qkjqssrdz 10

09/11/2024, 22:46

241109-2p2fvstfqj 10

09/11/2024, 22:44

241109-2nsgkasrbt 10

07/11/2024, 16:00

241107-tfl1taxpgl 10

10/02/2024, 17:17

240210-vtnl8sge36 10

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:44

Sharing

Report Analysis Logs

General

Target

ggpermV3.rar
Size

1.0MB
MD5

ed2426ae5c805995c7d688f00a7b48ac
SHA1

f43458fc7d1915ba608bc6adc4acf94359a4dd94
SHA256

c4d74e49c44c880ec1b4cdede24423872f931e617b33d6bdba31e0534a12b809
SHA512

412d9443881c771c9799fc708991c8af0ba7caa83ae0b135e42e9a0c0ddd19961b55bd0353666d20c4344405e820f69b65dc947a5028a8f998ab10a18b189b64
SSDEEP

24576:s/zhFNfCWngFSp+6ev8ypq5uKxWRbdZl2:uxvngFS0KyEQl2

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4832	7zFM.exe
Token: 35	4832	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4832	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ggpermV3.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads