9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511 | Triage

Resubmissions

27-11-2024 20:39

241127-zfpdtszjes 6

27-11-2024 20:33

241127-zbwbksvqhl 6

25-11-2024 22:14

241125-15w1mswlcp 6

25-11-2024 20:57

241125-zryrmswke1 6

28-09-2024 18:21

240928-wzje5ssdlc 10

Analysis

max time kernel
98s
max time network
106s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25-11-2024 22:14

Sharing

Report Analysis Logs

General

Target

skin/skin.zip
Size

5.5MB
MD5

25a3e3d3a0c63428291aea0352b81e43
SHA1

0f7140b34e4b3f3fc7ac2c6cbabc9909e76e8687
SHA256

247ee15ab91e6dd08abcf7e621c32aede0557c5cc026d44402fc57fcbc488f8f
SHA512

bd1dbb7bad2c2c27bb8a1b8270aacdd94a66fa7702f746555330897e3a1318f9114e761f902541d74bd2e820e01377505482ea390626e4735093b1487308b5a3
SSDEEP

98304:BlI1D9ODI0PDz2L/qn3tJH8KBxDlBdWyXO6h1MZkH9uBlhA:BkD9ox3tJH8uBzO6h1okH9uu

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4400	7zFM.exe
Token: 35	4400	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4400	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\skin\skin.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads