04cf383bf7d4e2f3e23c162f56c46b8f1728a57e53b28f47c9eb2280a45fdec4 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 14:44

Sharing

Report Analysis Logs

General

Target

boot_fps_v2.rar
Size

20.1MB
MD5

2be5d8faf40ced85b24204da86425cfd
SHA1

649e935ea6e27357558dc8c079cf3cb28a724ee5
SHA256

04cf383bf7d4e2f3e23c162f56c46b8f1728a57e53b28f47c9eb2280a45fdec4
SHA512

56fda3890457cafd6773c549472610e21f9803284d9d2f1e9dfd2cd043b124675680e47526b80526c77583b3d86cc0d7e6c37f4f92dd2b7a1bba0983650da802
SSDEEP

393216:P2WD2NrtrFEm3bqn4fXuqvxKiHFkzadFewtRG6a6LQbZJ5a:VDmZlCrqJU2fHpLeZJo

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2640	7zFM.exe
Token: 35	2640	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\boot_fps_v2.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads