88f10843fd4b876ea4a261e9d8e5019c3e1fb3a4640b9d13f2d258ed7a3921c2 | Triage

Analysis

max time kernel
92s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

102.0MB
MD5

f4475f217cb2752cfd0deb2fccaed708
SHA1

4aae9f7fabff60eacd4b7fcd9468323015755f3d
SHA256

6c4e6fbcd867da356f8510300c8b9a093b63202c90ad3239a25f3424ea76d567
SHA512

c019c6b3d4bd0751d8dbd9e2b19e479eb10d2548baed4957b21256a01a87896588408538da560d6933ad29ffef2700732723dda794f869e3f8a832e10679a819
SSDEEP

3145728:aw4blb52h3yslb52h3ywhgDOZB931nMhAnIr8g6/:awYt52hJt52hBZB93lcAn5/

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1864	7zFM.exe
Token: 35	1864	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads