cbdf4c005fe6b2942c3e295264612adf301b864b2424d2e3a6426192803071a8 | Triage

Analysis

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-01-2025 19:40

Sharing

Report Analysis Logs

General

Target

GlоbalСhеаts.rar
Size

56.7MB
MD5

9098b7e7b2a240e08776462888d921d7
SHA1

283c449ae2e0110078737e4cb2e3c9d46cc4c693
SHA256

d78a9069301d154818259863912fd5579ed9a3e9b748b5cfa51db22716d871d3
SHA512

d7f00c624a805a78ae61663993c9be26a906947012cad8762ab95fd848cf4c2a65be02689d2b57e5dc9eb348829d1d608a1a8b5060158430650d54e80ed586af
SSDEEP

1572864:3N74yONRNcQYLQASeroCHgAaGCfohaKOXo61f:d74DHNnYZxrZHcfLKOY2

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3504	7zFM.exe
Token: 35	3504	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3504	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\GlоbalСhеаts.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads