d41d01815c6069b8b00bf76af27255bde4a42ad7da41ff37b7687246dcef4121 | Triage

Resubmissions

27-11-2024 08:07

241127-jzzqxa1rem 10

27-11-2024 08:00

241127-jv7wqavlh1 10

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 08:00

Sharing

Report Analysis Logs

General

Target

KiwiXV2.zip
Size

1.9MB
MD5

4092079f655b2c1f998485a1be4d95ff
SHA1

ed2cd59eca0acc4f76673929200e1501f580e54d
SHA256

d41d01815c6069b8b00bf76af27255bde4a42ad7da41ff37b7687246dcef4121
SHA512

fa7bf35152c9144a6306a44409583b1590ec74eac51e6191b8533a9105efb1246685b0b142b8d52bc161d65867e274cf3a3782b6f1cd3ab2a6bf432de29ffbdc
SSDEEP

49152:ckFEIeK74h3OdesV3tvdc3WUUxTGFfe8gwO:2IeK76Wesi3WLgFe86

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	5080	7zFM.exe
Token: 35	5080	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
5080	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\KiwiXV2.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads