3d36c412f3e9bd9983629b45cc34dc5ac1d48cec7232a3d8ace19ae1181f7649 | Triage

Analysis

max time kernel
440s
max time network
442s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 10:16

Sharing

Report Analysis Logs

General

Target

cincinati.zip
Size

982KB
MD5

4b1eee4ab5a46f1215f7397a650e385f
SHA1

93104208b9a3e25900e2c6489c398ec1ae07db56
SHA256

3d36c412f3e9bd9983629b45cc34dc5ac1d48cec7232a3d8ace19ae1181f7649
SHA512

c25c93642125540ac105932fe813243357df50d48cea289effa259a3e7cc2b272e3674c3119ae075412d214ca71b05d9e9414d0a6d50d033364bbf2258d07bb3
SSDEEP

24576:toTUYr0y8REypuQNALZmH5H81Dn81bQ1Sy:t4USz8REyc3LZmZKn91V

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	1632	7zFM.exe
Token: 35	1632	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
1632	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\cincinati.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads