fcf54eaf0f05dae2521ce9a53b67a0ac8a72c98f9f8b25a9258fbe1261f0be5e | Triage

Resubmissions

22-12-2024 05:16

241222-fygbdsvnft 10

22-12-2024 05:11

241222-fvgsravpen 10

22-12-2024 05:11

241222-fvapfavmfw 10

22-12-2024 05:10

241222-ft1t8svmet 10

22-12-2024 05:08

241222-fsntaavnhr 10

22-12-2024 05:05

241222-fq43gsvndj 10

22-12-2024 04:38

241222-e9fzbstnbs 10

Analysis

max time kernel
92s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
22-12-2024 04:38

Sharing

Report Analysis Logs

General

Target

tfd.zip
Size

6.6MB
MD5

44da30588e79926aa259c03796820e6d
SHA1

37bc83fe0487e8c1f7f309983af78a3b3dab24f2
SHA256

fcf54eaf0f05dae2521ce9a53b67a0ac8a72c98f9f8b25a9258fbe1261f0be5e
SHA512

1ff5a5e9f840fdf7713375c9294149f5265d1b09645eb00c2cc2d1ed07847a7bc990cc3aca8aaaf4205f9415153f9563be630268d28335a85bd1808cba3d8e0d
SSDEEP

98304:Nkm/OuBU0P2VJEgdGuTzUlD4JWX++gLCrK6UjqHiL7y3qF+Ok+K6QppKOU:KmWXXEgEuTzcOpuGDqCK3q0Xkt

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1832	7zFM.exe
Token: 35	1832	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1832	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\tfd.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads