eff920ad73b1bd4d2def6b79a52c4fe0f449902044c8efbbdf65afbdf93ef410 | Triage

Analysis

max time kernel
149s
max time network
165s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
19/11/2024, 18:09

Sharing

Report Analysis Logs

General

Target

WinRAR Pro 2024 - Full Active.zip
Size

55.8MB
MD5

ea081bf71035f4c204696240c1f87469
SHA1

f55949c7871806fbd88b5ac5ea72f7aa742f00ef
SHA256

eff920ad73b1bd4d2def6b79a52c4fe0f449902044c8efbbdf65afbdf93ef410
SHA512

e400548244b8f7294832883d5fb9133e99db16039d63bbb6c931d33aa47bc4dad4cc974bbe05cf9d99c4ac10e62a237859ea4b9a86bf34c8805e9393d07df8c8
SSDEEP

1572864:cg7zo9RW2q1bND/7Hqb2sOgul5mRgD33QsENn:cyIRWf1bNr78cEiD33jg

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3908	7zFM.exe
Token: 35	3908	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3908	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\WinRAR Pro 2024 - Full Active.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads