56a7f2bcc9956a3ab23be18b0d44fa0ff30921ba87bc258eb8e800ce9f21f798 | Triage

Analysis

max time kernel
92s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 16:43

Sharing

Report Analysis Logs

General

Target

AffeliOxy.zip
Size

32.5MB
MD5

fdd807d3a9362890cd5ec88474c15338
SHA1

7c890f558ab5a894a8750bec0c2b1ca4db589c78
SHA256

56a7f2bcc9956a3ab23be18b0d44fa0ff30921ba87bc258eb8e800ce9f21f798
SHA512

554081aedfaa2cd69edfd4f043a3f17c12008917fd36ac7e5031a7dba6d3e0c2fd61630eb3f70383564e5d7727298a0d95d0ae1fa78e8ac9e0391c4505c6870b
SSDEEP

786432:EPV8ydWkQRYkhZ5AQ9L2fELTw+xrn5ONFP:EmydUxiQ6EwknQj

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3116	7zFM.exe
Token: 35	3116	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3116	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AffeliOxy.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads