102fa87868d13ae5527dc3f538641581bfb9e3203497ceccc119916df6e1d032 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 08:49

Sharing

Report Analysis Logs

General

Target

use password 704.7z
Size

35.2MB
MD5

700142963aa62a58866861d1768bdabe
SHA1

1d2eb175284ca568c02cb4c64a8259020327967a
SHA256

5618bea2cfaedb3a9c1aa9b95389b2d124568a3b98c3abbf39f77c0e56e49752
SHA512

848b033e228b73bd6f2a84b4adc9c36e957c7dced2236c62c3cc46e931e2b5b38e7a7a35cc8dd44f7d3828cd34455f197a9c15716ae6798b0b8e59b8569e9004
SSDEEP

786432:yd24Ie/4bpbiOKBR8l6FKJ3NjHyjPJjnMuVggN8fOudh47/+rDS:6Ie/StiOOYJsjP9BifBhwGXS

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2544	7zFM.exe
Token: 35	2544	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\use password 704.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads