5ea69fd3207a0ed6b42d5e406ee3391ddfbe19c368c7e28a6dc500fab7e84f4b | Triage

Analysis

max time kernel
95s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2025, 13:42

Sharing

Report Analysis Logs

General

Target

merge-force-ww.rar
Size

7.3MB
MD5

27b3c32f2943d6dde38ca24ba9410f4e
SHA1

adf69759376a7207d9424e5b7a4bb59a9bcf1af0
SHA256

7b2e9d3a99871c7c8cd0ce29f13caa85b04d6728b4edfac014d8cc6689f9c6ec
SHA512

3f25e06e71e5feca1c26fa9de2df1d369250a0c35cbcf888b723522dd7a3efa728adbba799d7cbb39f97eb50e11a62f788dec47d17858ed56a1709f6ea85e514
SSDEEP

196608:vv5NUyjdwGgKiqcYK0mWIQZfbUufzHlLFJIsI:7UGwxKHH+ZQJpJOR

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4992	7zFM.exe
Token: 35	4992	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\merge-force-ww.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads