783b2eb5ba4d3f90ed1369942f9071135c45504d870ab8cefce4edadeb35c8f3 | Triage

Analysis

max time kernel
154s
max time network
281s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
19-11-2024 14:00

Sharing

Report Analysis Logs

General

Target

premium.rar
Size

8.2MB
MD5

30dfe9a6d1e3f518d4337a628442db14
SHA1

95d373603a43f801578d4a7cde22e2c07adeb5a9
SHA256

783b2eb5ba4d3f90ed1369942f9071135c45504d870ab8cefce4edadeb35c8f3
SHA512

b8e1b7ab53607a72fb26fe7ce81402c33b24a7ce69c72edd48b93912ea17754d291bc89caf1bc64cb85916d99d0845ecf9fad643cd5400c3412a9f998c338fce
SSDEEP

196608:AVaDkIfJRy+5JeT21KNGWVi944FXeXvvIdyNEaP9OL6JPeLIcj:Acwm1KNGWVSFOXbTFpJPe3j

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 1224 7zFM.exe
Token: 35 1224 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

1224 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\premium.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads