bc6612f74ffa0035fa08e062880dae1e38305c7c22fab3619b7c638e0cb66528 | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 13:18

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

74.6MB
MD5

cefd91e43406a87368424e752d9bee7f
SHA1

10af8ee5ace6bca1cf505d78484c75a191723621
SHA256

4abf3870820668dcd394fb2cb12e42326fb6dc642a0367f9ff8c797044803fc0
SHA512

f28444dc45f9f054e7d28c46f926ff2a53f4be26a90750fcf94214f00210fb06b402204d08b55027122c576b7a2b8a460df90e4095e68815f35458199498ec16
SSDEEP

1572864:aJ39Kk9MWr5vSGB8ceyIS7nqYdd6hIEhSmn6nlN/xFEu:pk9Mk5f/vP7nMhJnUXxuu

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 3920 7zFM.exe
Token: 35 3920 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

3920 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads