42b828b9a12a08d6d54cef29054a65c8e3d47147e67d40237b2decca4809c60f | Triage

Resubmissions

08-01-2025 17:49

250108-wd7kvazlcj 8

08-01-2025 17:45

250108-wb4feaxket 3

Analysis

max time kernel
94s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20241007-it
resource tags

arch:x64arch:x86image:win10v2004-20241007-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
08-01-2025 17:49

Sharing

Report Analysis Logs

General

Target

SWA V1.62.rar
Size

1.1MB
MD5

6e1efefb3225679ae03ef936c3c81575
SHA1

c9e7de5bbff3bc0782b1e91023a7ff8fd9976688
SHA256

42b828b9a12a08d6d54cef29054a65c8e3d47147e67d40237b2decca4809c60f
SHA512

6df9f84e64ac7fe10bb552866c65291a9007c661d53244eae729267b27291c3a3e61bed89cbea9ff7826a01f3c82185625688ec9c1820812364fece091cef7f9
SSDEEP

24576:pLq3QBPdv3XalrWfiODoUKooLRuIwatKRLRGVuVPtUx7skxZNXptpfcQ:kQP3XgqiODtoLgLwaUhN5PEQ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3264	7zFM.exe
Token: 35	3264	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3264	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SWA V1.62.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads