644372d31b62c327439aefff7ae0d2d2b09cf8a9963c4d10408731358c1ce879 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 15:28

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

74.6MB
MD5

220de7ae6a29b2b20e66ff46605c1b0f
SHA1

c71eb7e69816d14d5f8d88b6f24ecc597ed8e021
SHA256

904efd8694afce96461b4076e210d6864ad58ec44986d27a17703155dd26d476
SHA512

0395cc5819bd221109b705af76f4ee8e1ba7e60a7337aa765657ec0398e0c8779ff860e4d505632085ec1b588dd38243fa1d21fe87234f5d81f7cce67de5eac6
SSDEEP

1572864:SJ39Kk9Md8JlB8ceyIS7nqYdd6hIEuZRob8j7yn8QNjBkjsD:xk9M+/vP7nMuvWs7y8Q/k4D

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 3332 7zFM.exe
Token: 35 3332 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

3332 7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads