601a5853fbe96c1d11fec29a95dc9efcef2f457a8915e183c789f71848786bfc | Triage

Resubmissions

19/11/2024, 15:13

241119-slznesybpk 3

19/11/2024, 15:10

241119-ska9faxelg 3

19/11/2024, 15:07

241119-shdxjsxeke 3

Analysis

max time kernel
90s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19/11/2024, 15:13

Sharing

Report Analysis Logs

General

Target

Yeis 1.5.rar
Size

3.2MB
MD5

9ea39ff96d82d2cf813e16c7910e54b9
SHA1

b9f1f8f7ba5005ffad023808cc02dc8c24662222
SHA256

601a5853fbe96c1d11fec29a95dc9efcef2f457a8915e183c789f71848786bfc
SHA512

fe705625cddfaed5d6566bd79cbd69dd07d523c71ca2e0978f6ca6adddca1c6c30410dca075acf774a27fc81e9b1e9ca2cc783b4aa7a9c174c045da2570021b8
SSDEEP

98304:rEc3CyOEdmvvzdVO5ZlU6IgQjU7Db+CSh8acXAw7i:t7DE3O5ZlU6IPUHG8aQAwm

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1720	7zFM.exe
Token: 35	1720	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Yeis 1.5.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads