ab5a257da8dcccf5d9f6d018183c2478644e3af67d4c3bb2b3c7096b5f072172 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 22:54

Sharing

Report Analysis Logs

General

Target

SetupInstaller(Valo).rar
Size

42.3MB
MD5

92aae9b92babefe0a2212191c86424a2
SHA1

3a9f6f56663fc82e0f207ad505c3181aa9483d2d
SHA256

ab5a257da8dcccf5d9f6d018183c2478644e3af67d4c3bb2b3c7096b5f072172
SHA512

47c343e74240cebc74419e3beb2e83b3a71b6b561c934b1766e5a4f98936a285153069c8aec0572c0da9fccfbf9029be00267c7e300e9c8fc5a05719b44e4528
SSDEEP

786432:I94np7m5bJa88oa6l7VQ1LvkWW2sxP4hSOdOQcyrJXhgmVnxq:Pn0b8Z9k5xQmyrLgsxq

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	440	7zFM.exe
Token: 35	440	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
440	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SetupInstaller(Valo).rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads