15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd | Triage

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 13:49

Sharing

Report Analysis Logs

General

Target

empyrean-main.zip
Size

458KB
MD5

6535abdad3ba947fa280b8d5f836751b
SHA1

5c7d20d35bcd2049fea5c07ad4d83e4e0e2fb494
SHA256

15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd
SHA512

5edc1bac7c636d2488578d97544cedd18f61124f2a732b49ffd891aeac00a19af6dc4c42e8e4c9e52f5ae0e908f059219f0ceae698d9084453335877bea132a1
SSDEEP

12288:oHl1OgPc6NQpZZbzYQqKevezSE3l52fsl:oH26CpZNUvezH52w

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2844	7zFM.exe
Token: 35	2844	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\empyrean-main.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads