d7bd07a7eb03eb5504dc3709eaa3acaa46d0953e62a559643f0230a6512624f9 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 10:00

Sharing

Report Analysis Logs

General

Target

star0pti.zip
Size

16KB
MD5

86189cdc7796c94aff170a7d3b1fed50
SHA1

cd70922492c1e4fbc93a993e42c06f8137199c2a
SHA256

d7bd07a7eb03eb5504dc3709eaa3acaa46d0953e62a559643f0230a6512624f9
SHA512

d180982f180b76d9fe86564ebebaee30b2886972525f29fd63f4cbf9f1ec4842907be01e4198581f16bbbc72712e46aaa36c26ce3f284a6152d8b00038db5267
SSDEEP

384:J31/+iM2rU5eDwYvEVaK1V/MhcdCs5lFwKfDuKw3KofEMP1jVJabt2G:J4HqqGKT/MudCs5letKLiJVJa2G

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4072	7zFM.exe
Token: 35	4072	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4072	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\star0pti.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads