7a7e809bdd2430b7577b99f2e28a803f52a3b1e7f95c0da2980fee1cb7a3404d | Triage

Analysis

max time kernel
253s
max time network
317s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
06-01-2025 16:30

Sharing

Report Analysis Logs

General

Target

external menu.rar
Size

118.0MB
MD5

c2bc224a5c550413f2339183d8793e1a
SHA1

359a914dafdc343cb0d29318dda6c7d07cbc24fa
SHA256

7a7e809bdd2430b7577b99f2e28a803f52a3b1e7f95c0da2980fee1cb7a3404d
SHA512

3022aca0ab51bac63842fd0840203301f12da4e0a0a7af17f6e54772dc3f259a192a05fc496413fba0121330dacfb60b16f980140bae54ece5638f77e3af01c1
SSDEEP

3145728:7NzSEGDBQNRUzC2JD+W6bUfwu1jD5LefIc44LkQkJVh:JOKsHNsbuh8gn4Lkh

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	5048	7zFM.exe
Token: 35	5048	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5048	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\external menu.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads