bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa | Triage

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 01:37

Sharing

Report Analysis Logs

General

Target

lib 0.zip
Size

34KB
MD5

0a76bd3e26768bba68aca3d210997069
SHA1

753690994a18cf58ed0fe3749d16448b763047b8
SHA256

9056b87f079861d1b0f041317d6415927d9ffb6498ce2530ff90fda69fa64e78
SHA512

14408ea7f44bc365a58d7480fff9ea3b10fa21bfbd3363c6e30b74a4d4121677e20ce1108cce12c203f0760768aee1c1aa69b130e090c409f9a516ea02d70c49
SSDEEP

768:ea3asamaSazaYapa+aPanaca9aCajaIal:ea3asamaSazaYapa+aPanaca9aCajaIS

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4000	7zFM.exe
Token: 35	4000	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4000	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\lib 0.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads