316fac5ae2d4e250b1c0f10b4388fa2c6c3407b118e539a7d865613e373628d9 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 06:04

Sharing

Report Analysis Logs

General

Target

Pegasus.zip
Size

7.7MB
MD5

4261312a1666ccaeb48d55ddd1d64559
SHA1

620947ef46f8e8f7efbf9442845b81901c8034b6
SHA256

316fac5ae2d4e250b1c0f10b4388fa2c6c3407b118e539a7d865613e373628d9
SHA512

e0677d4202c94df0bf67f24b2f49cfe4a301a2a724282769e22e47c245233670ccf3ce14e5aa2c3535d3dd00b603560e399f521c0ba7232b71a84d27acfc50c8
SSDEEP

196608:NeX/gzDmUkWxyaB/VDM2tR+vI6FXu7VkpU54rbfKEqedf:NC/+oWxf/tRc3peG9Xqedf

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1096	7zFM.exe
Token: 35	1096	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Pegasus.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads