5ec6b5659fc1fe2761ab4fcd4b44be5722294c3ea5dc8089b465bd95e3950684 | Triage

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 04:38

Sharing

Report Analysis Logs

General

Target

InstalIеr-x86.rar
Size

52.5MB
MD5

15f060d91d50ca10190a785d6d005619
SHA1

6f42717df8c86f588cd2c52a154ca9fc44e48efd
SHA256

74fa779ebc5ae9e1896ebb79c535f1ffb2ca9fe7057be24e57df2fb39b3685d9
SHA512

13743497da861eb87096f9f832aa8d47db4c48237efd48ffefb441ba9c8d7f90662779d7bb8b5220d15433530cb2b27c528b6abd07cad7927a8db5f2666676be
SSDEEP

1572864:NyASP3JnHeLGGAWIFQmeO1Le4TTGDc2gx1:NyAi3BrG8FXJLyUx1

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4484	7zFM.exe
Token: 35	4484	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4484	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\InstalIеr-x86.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads