42d160d7a91ab48d7ff8062aaaf678063a2866663943aa55c1e8b6a86518c771 | Triage

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 19:35

Sharing

Report Analysis Logs

General

Target

COMBO EDITOR PRO.zip
Size

1.7MB
MD5

b539b73076fdf7f3cb1a66a67b20c8d3
SHA1

946dea11d5cfb3bd5e518ffcf468fa8cd7c16192
SHA256

42d160d7a91ab48d7ff8062aaaf678063a2866663943aa55c1e8b6a86518c771
SHA512

db067d20e97bfc1d7fe6ad656f11b5427b359b388716556df0520ee6eab878fd199711983d46352a93fe721322be357b1acc58d2d24d9b018ba5c5752c1a4f3c
SSDEEP

49152:RF5gpYicHnjfFsX13dbdEjWTC72KYDcgUmNp6:RF5gqiMnjENBrTwcc18Q

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4996	7zFM.exe
Token: 35	4996	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4996	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\COMBO EDITOR PRO.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads