2e409cae7c78d6e62bb7821771b1ff25cbd098a2f2c4fadbe68bab5ebea4d773 | Triage

Analysis

max time kernel
299s
max time network
325s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 22:52

Sharing

Report Analysis Logs

General

Target

plugins/python/python310.zip
Size

7.0MB
MD5

9089b2f3111a9bfcebb744abb98f8f29
SHA1

42219f2834ba448ce71b9cd82ea2a281ea625841
SHA256

7f66d03b445f30bade9d6e185d23d143a16a057bb2439a29deba8b1268a77484
SHA512

bc8551775496ae72f281756193b0e44c5c78c1eec903ba49612dae29229d04e8983a573c8934e534f2482d224d537b0c1358198e8cd219e3e601b05b0231a51f
SSDEEP

196608:wYTSpowXBcKlhBjL8ooBZfX7ErlNPOMP6E:wQ96L85BhwP6E

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1460	7zFM.exe
Token: 35	1460	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1460	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\plugins\python\python310.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads