4f39c7599a824ba6f9698eb2ccf780ee4aa30a427ea3b8acc4254916068e07d4 | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 22:48

Sharing

Report Analysis Logs

General

Target

malicious.zip
Size

1.8MB
MD5

6e21499d32f36f93fa176f38fb4b9b77
SHA1

63136b30330cf86527a87f986c5eb5dffaba66f6
SHA256

4f39c7599a824ba6f9698eb2ccf780ee4aa30a427ea3b8acc4254916068e07d4
SHA512

5d665ce32e9fedc302c0487fc49c5f808f47e6fae7628926498931e50d98d03ff3d0ee5fb8cf0fa7c0c3a2b54e2f18d19a376ad9284b06433b9154b9d09dbe0c
SSDEEP

49152:R5BZHSCcUzdE+vpwuSXg3Hbr0ntqYHqcB:R57RniuSXQ7r0tqYKY

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4712	7zFM.exe
Token: 35	4712	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4712	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\malicious.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads