64127c3e92e08691e9b2ba7f7bc3513b98328ce514d645ae85565cb9563961bc | Triage

Analysis

max time kernel
93s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2024, 20:13

Sharing

Report Analysis Logs

General

Target

BackupCertificate.zip
Size

1KB
MD5

67ed09071131cdb37d818eb28eec4aeb
SHA1

42a0936b6a3cbeb4c22b059eea719c194d617130
SHA256

f9dfd2411ad346b9b7fd9f719b4ab9b698a1e6930ef8b0166cbc5163d528b07e
SHA512

0bb4722a08070675059b095d9755ffbaadfa1f5ee358ea016b10a0891b025a1df5b4db8213d3e17d8e63402322f890f842d9ce6ef1463672da5eeac24c808a3c

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2892	7zFM.exe
Token: 35	2892	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BackupCertificate.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads