4b33219c5cadb4d741044874f6f0184d45f43891d28ad5b489716d4da21310fd | Triage

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 03:42

Sharing

Report Analysis Logs

General

Target

IOC.zip
Size

1.4MB
MD5

f1b00142524ba8a4ddc691388a5020fb
SHA1

eaabba82a1c6689eb07ff4629daed8bc153fe42d
SHA256

4b33219c5cadb4d741044874f6f0184d45f43891d28ad5b489716d4da21310fd
SHA512

97ef7b89461a18a09adb5de37605e385c7bb5a2143f6df5b413747f78517fe032632adac51ddbe35b6904a7a306eabc1bfe67474a2cdf16e633c73b0bd0e9570
SSDEEP

24576:+Rjjcd4pTEcRst4DRCFT2+Ob902gk6OesN9yWHnBgqKErnV5y/u/0t2O:+1TTEcRsGRmT2NgnKN9fHiErnV5y/M0b

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	640	7zFM.exe
Token: 35	640	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
640	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\IOC.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads