dca60ed0b8eedef3dd3286251d8a4cf6ebdba50987ab98987c3ab909a01e95b8 | Triage

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2024, 10:58

Sharing

Report Analysis Logs

General

Target

dist.rar
Size

69.9MB
MD5

77beea4f62aa26e7209b07d41307fec4
SHA1

c137aa6e9b02775b69dca4e3ae9f02cc8e6cdf11
SHA256

dca60ed0b8eedef3dd3286251d8a4cf6ebdba50987ab98987c3ab909a01e95b8
SHA512

f87e447c79bb645fcf100242f035c19f4a712dff377bd1017d5b5b0c5bc685dfd071888ff9b451929333dd4b9b907488c4d7ec44f0a308635cae1d6690c8c44e
SSDEEP

1572864:NOMY/LkA0e7eo97rqARTGnDe/fHzbSh7Eqk3IN6IPQ+sCIawN:NO7O4SgfTOEh3I/YPTN

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2408	7zFM.exe
Token: 35	2408	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\dist.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads