003ce89e51fcd3bd332c4b5f574876650c78339bedbf4d661e31bea9a879b58b | Triage

Resubmissions

24-11-2024 19:39

241124-yc84ds1ral 10

Analysis

max time kernel
14s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 19:39

Sharing

Report Analysis Logs

General

Target

Zen Rat.rar
Size

26KB
MD5

01d69b3911f152aaeb3a3c7004dab0f0
SHA1

0667b4b6739bad28c0f0a087ff3bc7ecb214c261
SHA256

003ce89e51fcd3bd332c4b5f574876650c78339bedbf4d661e31bea9a879b58b
SHA512

d5ef02998a1df53dc713614bd25a33880770fe229ba1bf4a48fe218f6a070e51552ed70998893995c36366675e8976408c9e39774d5445e2c2d8d803cdb77c34
SSDEEP

768:RHMVIlezOqJi/d4C/VZOThn71HNopmFtE8:COlez1JGVZOTFvoyE8

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3916	7zFM.exe
Token: 35	3916	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3916	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Zen Rat.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads