7c9e308edff467528d167d0e4dfb7e17e61ba96ad413041b66c243869ef18721 | Triage

Analysis

max time kernel
98s
max time network
149s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-12-2024 13:39

Sharing

Report Analysis Logs

General

Target

软件使用教程/DefenderControl.7z
Size

494KB
MD5

118233a92e7e62658ac601b02f9f3c7b
SHA1

e0b7ccb384ec3daff55cdef70364bb57934dfc4c
SHA256

e56dc7603a16fc75622ff97f35b1b8a66a554cfe05c0022b61887f3a6874e284
SHA512

a6bafb444f561c5b3f92114f865976311cb5ed1b3ccec215e2780d255383c424aaadb0af93854b0b3d843435c4b94eaadb621391d5a63f968dfecc2e9b88f2c5
SSDEEP

12288:ppTGizva32uzU7SOvi56/Nu90uRKGyburq6f1dAYkyV:PTGSambQ56/OXI+rBdAtyV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4336	7zFM.exe
Token: 35	4336	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4336	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\软件使用教程\DefenderControl.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads