60c7b93fd71057e6beef15759f04ac62d60b5f28189d3ffcf1f73584c6b15759 | Triage

Analysis

max time kernel
423s
max time network
444s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 02:48

Sharing

Report Analysis Logs

General

Target

Unlock_App_v1.4.rar
Size

48.5MB
MD5

dfe1a6d784fd857917e598d6f2ef47b5
SHA1

57f6b05b78bbac9ecc66970cbed2da2a28add46c
SHA256

70ef4ae08f85a6a8aedf229c4ebe5e12cf3cc82d955c2731747d619926afa885
SHA512

20d226d38d9d1f445015c06f0202e5382a8262e167a0004e060f8e25ecf5f46b1ce089a19676508e02d514b4dd5821cb173a7b20dd563c458145aae7cc7c671c
SSDEEP

1572864:gu22WKNf3rxDyljOP3UqMfBIL482bTnkZpRu/L:gu5W2dMjmxABIqkVu/L

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3640	7zFM.exe
Token: 35	3640	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3640	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Unlock_App_v1.4.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads