78c86099f9d14307ddf5e1677deebb728a70dfc4fe2b669964a8cc77d2dc52b0 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 02:54

Sharing

Report Analysis Logs

General

Target

R--E--L--X64.zip
Size

12.4MB
MD5

c15fd8fb24e218465eacb83034976dbd
SHA1

476d1af8f1f4db7f4a47cb5035c709bcfb5e18c1
SHA256

78c86099f9d14307ddf5e1677deebb728a70dfc4fe2b669964a8cc77d2dc52b0
SHA512

4383d1178a516af4bf91d6d017f989926c23ad18d3d5415e7eb6cef871b0435f28f950f3063b61bb53069c76bcadb0c65353bac7963a00b6d93a0ffeed0cccd0
SSDEEP

393216:DLrUmykpCwOk1vFRSCFFJLZtBcYdAtA8Rxm3w9lV:jUoCe9ACHtBlz82SlV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4772	7zFM.exe
Token: 35	4772	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4772	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\R--E--L--X64.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads