10fb0668623a29baa0c1e54448750fa18d3e3e6b5e8622f5d0dacde9513dcdb6 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17/01/2025, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PhoenixC2-main.zip
Size

6.8MB
MD5

4eb6236503b5183b472da37e64cd1607
SHA1

7c3fe88f5e3d62461e847c1cc6033bb157e20300
SHA256

10fb0668623a29baa0c1e54448750fa18d3e3e6b5e8622f5d0dacde9513dcdb6
SHA512

399cae4b1707841266d152336c6d85d9de6ed99eb3cddb09af747ecde6c7e47fc0d8e16d7cacaae10aaacb62650ab4ebaa82d1c8bdc464bfcfcfd843eae80004
SSDEEP

196608:dq2Comx5bpXRCX2Xmb8jYYr3t/WabbfUogn+V2fA:QXNXRW2XOWvrd/WabDUoL0A

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2512	7zFM.exe
Token: 35	2512	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PhoenixC2-main.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads