2737cf080df29967878d0f4161291dce55c2fc40d79f9c42ac51ae31bf624b07 | Triage

Resubmissions

17-11-2024 21:16

241117-z4gnwstjfp 1

12-11-2024 18:32

241112-w6wztaxmbv 10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 21:16

Sharing

Report Analysis Logs

General

Target

RNSM00320.7z
Size

1.6MB
MD5

39ff9a6a7b15b4bda77edcb789ae5f8a
SHA1

668e58768e9676bcb9945fee78699487b8308cea
SHA256

2737cf080df29967878d0f4161291dce55c2fc40d79f9c42ac51ae31bf624b07
SHA512

5be455c739e1018c9443f122fec602ba447c269c1d97f630f49bbe076f84dc8d32b9d1256b4016e08bca9af5c7de244c6237985564e6c803051e4f9cafde9476
SSDEEP

24576:R8OMBf51//LOZFku7d/t8s+5hyVWaaH6pdSEYzUiSomNdhII5Q:eOMR5Z/KvkuNdG3/WdSEMUMKqMQ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2256	7zFM.exe
Token: 35	2256	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00320.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads