cc955efc8aaa3c26caa9b57604ee3bb2aa4039b946b8c2aea8e7d2579dab18c7 | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 16:35

Sharing

Report Analysis Logs

General

Target

DDOS TOOL.rar
Size

5.2MB
MD5

01abc57a648bfe6c15d0e60cee8df24d
SHA1

6879b1d3f182d046297a5a51e4629ac79e8eb9bb
SHA256

cc955efc8aaa3c26caa9b57604ee3bb2aa4039b946b8c2aea8e7d2579dab18c7
SHA512

9776436a6f4d0a61ee92d12955263ab6a7d40e86e79929956af8e314cb34a262e32efc46a2f11d09815dc8ed64d1fdda62cc42bcb526dc8dad2c5fb4ae0002e6
SSDEEP

98304:c+D78yvHmfPHf5ra0SobmnJolavV9sR/1ZfoW5Uxx5gw:c+TPE5rT6nKlS9E9a5gw

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	3124	7zFM.exe
Token: 35	3124	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
3124	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DDOS TOOL.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads