c535648fcb637565a3253706bc12af2c9a4def5c243d3a388db5b8a6d91181a8 | Triage

Analysis

max time kernel
94s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 11:26

Sharing

Report Analysis Logs

General

Target

SWIFTMESAJI.rar
Size

471KB
MD5

07841f5e7aedf482b39c5bb10ca5de75
SHA1

800640ccd118bc7f6440b00cad85c2eceeb4f5c4
SHA256

c535648fcb637565a3253706bc12af2c9a4def5c243d3a388db5b8a6d91181a8
SHA512

2c8a22693ea9641c844be6adb27e9c2c4ec7132565af8952ed00844ef57e4783bf87c4202bc07f773cc6c8945c3468a2eac7505f444b4c043130706e4d7f3e3f
SSDEEP

12288:pJL7j9V0lUau2sMCPsGHpvynMqCeLNHzPRVVA4xWbTic:pJnjiUau2sMCPsG4LLNHzPRV24UbTic

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1916	7zFM.exe
Token: 35	1916	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SWIFTMESAJI.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads