3c328e9f25a277e022237b0d45d18479fa5db72c4031cc0135cb33f57e3121b2 | Triage

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 19:22

Sharing

Report Analysis Logs

General

Target

CrazySploit.zip
Size

8.2MB
MD5

6851b0717dfdac6d04d5fd2acc026092
SHA1

88da1a3ae244d261959aa239de99ee39c4c96482
SHA256

3c328e9f25a277e022237b0d45d18479fa5db72c4031cc0135cb33f57e3121b2
SHA512

69f604f87080eb2407d7b6b628191005ed0ad17fd4dd769367ebb9170dd4bf1e3da5f1b8ced31919df628e10f66e2056fd57404f9926dfd0d822c7e2d630802d
SSDEEP

196608:DqSM6An/yKmxkGXMcmzlf1DplqChiHbdkdVt:DqZhayGX4fdC5kt

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 4300 7zFM.exe
Token: 35 4300 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

4300 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CrazySploit.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads