b5748bdb4ab2a7132b1bec0c0e421e18d71b8ecb73351c6ae1ce6239c9c55462 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 12:52

Sharing

Report Analysis Logs

General

Target

Exodus-12.20.rar
Size

107.8MB
MD5

0eb1d9d05ecf3fbb9fc61fbc2bb98db4
SHA1

095aaa4f949a5b8c98b9042916c6feaed77ee4ad
SHA256

b5748bdb4ab2a7132b1bec0c0e421e18d71b8ecb73351c6ae1ce6239c9c55462
SHA512

f2655ed4b339e70fac6c5962332869807edec9d761df9f68cc2419b1ee7fd786bb370b9e3ab35cbd5d751f9a5df3778895a9e977acf9b7749155c71d97c7aa11
SSDEEP

3145728:/+YDA1+OhPQKFip4i2rZ78kHDyKwuHloqqtrwNVO:WIa+OBQKFY4N0P0lo7B

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3640	7zFM.exe
Token: 35	3640	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3640	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Exodus-12.20.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads