9a850fb509f0cae0e0351c783841490488d3977981a283f1b2e70d13970cc81e | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 18:48

Sharing

Report Analysis Logs

General

Target

0PENWE.zip
Size

1.5MB
MD5

46d1c430cf69eae0cf8df0120e31c573
SHA1

0e2a88cb635a0a3e9155fa516101ab3cabf9acec
SHA256

9a850fb509f0cae0e0351c783841490488d3977981a283f1b2e70d13970cc81e
SHA512

c22e30a722d7ef21b272080e0b1bf2204fb5230bd5a2cedd122af10c111813f372b9241fb7abd574862549aaed464a8e6f3b2f7428984a13c52d6f17d75ec4d4
SSDEEP

24576:2hUK6aoivC/XYzG4IKBd1F0z/xEyf+08A6ZlPwBbcvvnfF1:TZa0p4NHq7xC3vfT

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2100	7zFM.exe
Token: 35	2100	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\0PENWE.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads