490e899c95fed294e6f4fcecab730594a55bd6260c730b9b8d6cb2efb69d9ed6 | Triage

Analysis

max time kernel
93s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 14:50

Sharing

Report Analysis Logs

General

Target

GalaxyPr00j33ct2.53v.zip
Size

15.0MB
MD5

e6ae7795c2b37d3a134bb2696fbba28b
SHA1

e78f6d91c7603db604d33d769924fce1bf9c1dd7
SHA256

9960ca609ac2360ac63d18f6d780190767f8da977993f725bcf349764fb3a37c
SHA512

0ffee69050552e609e92541a3ee49ca34c6b4b86a7db955e5b64daf901af7ee12f16c33a57dc1499b0ffa87dd7793da8de2922a8f6b693701ea8264c31d6997e
SSDEEP

393216:89IRNP8UWsnXbx/4Vwc5SOjcip6FCD1XE0sG:/bPxc6cLcigFCDx3sG

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1076	7zFM.exe
Token: 35	1076	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1076	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\GalaxyPr00j33ct2.53v.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads