c56b66a485a26d6a815e6fd6d5adb7abb6a2d1c001aae3a569a76b9ffa54b735 | Triage

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 18:46

Sharing

Report Analysis Logs

General

Target

Xidrf-gen.zip
Size

63.2MB
MD5

0266aa8ca1f0cfa75a5a16a1c57af296
SHA1

60877a6ab03279b2afd77dfa0566fd9c0f605da7
SHA256

c56b66a485a26d6a815e6fd6d5adb7abb6a2d1c001aae3a569a76b9ffa54b735
SHA512

6911861ff514fbef9bf785cabff0ccc3b2b08e8feadfacdef0406938de422859ece1d9fa64f54e8ebe477726df688c304136722a62983a6a471c0edf74cb4f7e
SSDEEP

1572864:BIGssbOjOvps4Sea/AU03s9SvL07pyMS1Cg:KN+ps4SeaYU03aSv9MS1Cg

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	676	7zFM.exe
Token: 35	676	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
676	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xidrf-gen.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads