ea98c9bf854db4937cdd2f7430d21d72169cb3a5f676ffc41e71659b250438d2 | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 10:20

Sharing

Report Analysis Logs

General

Target

Setup_Update.zip
Size

346KB
MD5

eb751de314ba1859e4fa6ace8ac7bc51
SHA1

c47e21d1db58017a96811bf73d96933f0bafb0ce
SHA256

ea98c9bf854db4937cdd2f7430d21d72169cb3a5f676ffc41e71659b250438d2
SHA512

c8b7547b90498d20790ab941642b8e128e75ea9585c7dd749805e597cd214720d23e5d4761b8fbea058bc28a5343c2dc123e9a251da2ea72cc7584f6648713ca
SSDEEP

6144:jnVs5WDMq+8Z+hn5dXsPx9+HCwIsKDQeWVIbZhholaE4bX:7yMDMq+8Zonv8Z98QpeGZXola1bX

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2932	7zFM.exe
Token: 35	2932	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Setup_Update.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads