715d569bc70ad28d534098056c6a523907ed578d5929bcf6aab8e03e9f4261c9 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 02:22

Sharing

Report Analysis Logs

General

Target

ExL4uncher.rar
Size

14.7MB
MD5

2be12e78a009eef591106730a9779e6c
SHA1

0b163a792ed4489aae94f87a30f4ed0f659e0e4c
SHA256

dc500000519b53acac8dd21180edd616f11058371aa0de58e4b71b02997e4375
SHA512

db22c0d9241a256ca3fff9263b1d9776f5dea9a6db5a3ed44bb5d8505b4e2821aff6bd14eae8038ab455f66b9d3348138d06b246f05d2fd27f834da1c152fe0c
SSDEEP

393216:E6UnSk/SIdzSgjITuONl95AUUl5GTUOdUt2MZj0IW8ZvC2o253:ny/tS95l9Kl4TmZ4p89H3

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4956	7zFM.exe
Token: 35	4956	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4956	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ExL4uncher.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads