6580ba559132e13759f8450b811b42f0b04aa14a75bcddb1efc9227d5baf1e9a | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-it
resource tags

arch:x64arch:x86image:win10v2004-20241007-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
20-11-2024 19:07

Sharing

Report Analysis Logs

General

Target

WiiBackupManager_Build73.zip
Size

7.2MB
MD5

b57b36543a4096321d946e59ad87e0c5
SHA1

a604e4ed10d1b6da86a94ec35128a5494432506e
SHA256

6580ba559132e13759f8450b811b42f0b04aa14a75bcddb1efc9227d5baf1e9a
SHA512

ea30141d9f960a61844a6c5c4dcb806babefdba4adbc519d04659a1e9d85d7019bf428555ed8fa14c2e2bd4afd0075747c42a0e1d6f3c08f5fbca2713e168e40
SSDEEP

196608:hZfN+iDR79YZP4T0GK1VH1gViL40shIYwioyo0:XN+aR79YZP44GK1iiL40Qwio0

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 2112 7zFM.exe
Token: 35 2112 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

2112 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\WiiBackupManager_Build73.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads