e44e001e305f340101bd0b72530d789640ce7914f459e5a28feb0b56082d6de2 | Triage

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 23:29

Sharing

Report Analysis Logs

General

Target

30102024.rar
Size

446KB
MD5

3426e3bc35fdca3bbf4202e7046ef109
SHA1

def0dcba3b14da1ec4549e18dd403304a7e675b5
SHA256

e44e001e305f340101bd0b72530d789640ce7914f459e5a28feb0b56082d6de2
SHA512

f142f05d961e6162849ee794d4cedbe33f988e8d85c08baf8329ad3d2e1fd61e051788fbff9e8aa4564df88e10463f27562520e9b8030a152bec88bcad207795
SSDEEP

12288:c3JfQGCZ4MZqcTTCLaS+cSN4W4rEE/huD:c3J6Z42O+cSN4W4rEghuD

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2560	7zFM.exe
Token: 35	2560	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\30102024.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads