3ea702511247744377d079fb03dedb87411977028c82b0a9bbe699a80d9c895a | Triage

Analysis

max time kernel
436s
max time network
441s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-11-2024 09:53

Sharing

Report Analysis Logs

General

Target

Ny(tt) WinRAR archive.rar
Size

3.4MB
MD5

744cc4b75cfe42285183a9ee33f63d9c
SHA1

b7be8ebc31509711b39526934a62860e04f35775
SHA256

3ea702511247744377d079fb03dedb87411977028c82b0a9bbe699a80d9c895a
SHA512

e22aa544b02b9807896bd25423f773dcc0b5ecf9b413a1b35a4842eb34f98c0a95dbab64832d247027516a0fc6b4dca4d566464c5ebf0d2017c0ae86155d47f7
SSDEEP

98304:5FyzZFBks3UFSuof/iXuNNeDiiPW2jbU/7:ryl3k0USuof/ieLie2U/7

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 3872 7zFM.exe
Token: 35 3872 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

3872 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ny(tt) WinRAR archive.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads