2d9c9ba012ae8a50b79ef502e6c7dc05451eacf69c598c54c31c91b9c1623497 | Triage

Resubmissions

01-12-2024 00:29

241201-as8kssvmek 7

01-12-2024 00:19

241201-amnnfavkek 7

30-11-2024 15:39

241130-s34npssjbj 7

30-11-2024 15:34

241130-sz6znaxmgs 7

07-10-2024 06:29

241007-g9dkbavcnh 10

Analysis

max time kernel
90s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-11-2024 15:34

Sharing

Report Analysis Logs

General

Target

resource.zip
Size

79KB
MD5

ac637a3a9ff6c74375edaa0ac0a20180
SHA1

aabc500757a8afcecf44d7ac0853d3943058d51f
SHA256

2f8fb59ba5fde76041bc4293683a2c21b234289090c78c7af30a85c1463b3538
SHA512

8f99b28925f48c50fa095b24c125964ee8d900db645d72d88506f6026c45e06e9d6e942425ab10dd3e9737a7d973ada6bf2551849d1eb7d679aa07fcc06e75a8
SSDEEP

1536:p79Yw64GhE3XEfLQL7RF9P2qbXggWT85EyWpZ:p7Ow64r8Ql+kQgi8yyWpZ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1080	7zFM.exe
Token: 35	1080	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1080	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\resource.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads