93a83646005dd03fc1f48b80305965cb4a92a6ebdcf8f1236887eb4486a822f5 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 15:00

Sharing

Report Analysis Logs

General

Target

alternative v3.rar
Size

308KB
MD5

9f6ab7ddf403a3c8e9d85266c0c29633
SHA1

64584ff4a9d16bfb5faa1f8a078b5e5c0f212bf8
SHA256

93a83646005dd03fc1f48b80305965cb4a92a6ebdcf8f1236887eb4486a822f5
SHA512

d0b8302740f7983d6a256d1c8010cf2f66969654e69bcabbcd8ff8f35a654470bbca1ff2ebcfd5539d87a2cf26095336f29c28e0c0e83e2da103b02ebb53645f
SSDEEP

6144:Nam1Vuzv5qXJEwwyFtMNGSGFSJzZtG9shLAAfpLVNyeXl/lJ6:NMumwwyFtRSG4zZtG92JfnMY9J6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3916	7zFM.exe
Token: 35	3916	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3916	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\alternative v3.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads