cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d | Triage

Resubmissions

16-12-2024 05:27

241216-f5kx6awmh1 10

14-12-2024 20:23

241214-y6jqlasrhy 10

14-12-2024 20:22

241214-y51bysvmbk 10

14-12-2024 20:13

241214-yzc98svkfr 10

14-12-2024 13:14

241214-qgw1masrcy 10

14-12-2024 13:12

241214-qfk7qsvlaq 3

12-12-2024 18:19

241212-wymq6ssnat 10

12-12-2024 18:16

241212-www7tssmet 10

Analysis

max time kernel
445s
max time network
1164s
platform
windows11-21h2_x64
resource
win11-20241007-it
resource tags

arch:x64arch:x86image:win11-20241007-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
14-12-2024 13:12

Sharing

Report Analysis Logs

General

Target

241127-xqsswsslej_pw_infected.zip
Size

12KB
MD5

79fd058f7d06cc022de1786507eb26e3
SHA1

86590ec8ed73fd2951587561dff5387e9e0e18e6
SHA256

cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d
SHA512

8316ac3782c05a3ebea4ca0868e33512e5ef29b251498f3af5ab261cd2010dec6b0eca8a57adcadb0d70653be2e22c0c2c137c7a38ec7b3d5ebbdd02e09c0227
SSDEEP

384:sBfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWT:wfACW6Dr8HWTHWT

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1244	7zFM.exe
Token: 35	1244	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\241127-xqsswsslej_pw_infected.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads