55ff23173fd9a290f2d8a8821bad30e41be053f755e609ca568f315a9395e6a2 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 17:04

Sharing

Report Analysis Logs

General

Target

absetup42.rar
Size

4.1MB
MD5

1e966c8b75ed5be8ba01bc9af3551fc1
SHA1

72dfd7ea793f824843d5434ac713584f1366ac13
SHA256

13cdeaca73ff9befeb4fda4e68a9e73bd264d13ade4e2e3f8e459b974586dcf1
SHA512

201e3c89558689a4e92375a6f416d54aa48b2ff2baf1fd8adb65be3eda23e0d110875c118d9bf744a707a7e6864c9f3a7c8b8e32b9a24963061c1fd6d591c301
SSDEEP

98304:F+j46QHpulKcYM6a6qMuFBMaCxPxgoA6LhwzdDuAALJ:FQculKc36g9LCxP86LjLJ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1888	7zFM.exe
Token: 35	1888	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\absetup42.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads