5fd43513f6196f17bc0c00e9e08653f4812311c7a737a60257188c6fe23893db | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 13:18

Sharing

Report Analysis Logs

General

Target

Ny mapp (11).zip
Size

28.6MB
MD5

8ec6bd395828d1f517d5e2e11bc3e3a3
SHA1

9a33448db0dec4ea2c278d6ca31d315e0a892fb4
SHA256

5fd43513f6196f17bc0c00e9e08653f4812311c7a737a60257188c6fe23893db
SHA512

e17c8bc4cf3a0c1f4535773787b5d5f123849252771d0b516773819f5822be818b06166993029e00697deee00e8778db30cdee1db86a3bc776658d0903e50b70
SSDEEP

786432:7QGi8g5jO9/6yG7U1LVAzQIsiCnVmHzhRDBGmkltmUkw:TiPjoiyMoRA5svnIhRDBpumUL

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2240	7zFM.exe
Token: 35	2240	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ny mapp (11).zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads