438d6c2d58ecf3acd3ad86b69b17519824a5b51a51698fa48507494c27570859 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-02-2025 19:28

Sharing

Report Analysis Logs

General

Target

S0FTWARE.rar
Size

17.1MB
MD5

bf2021fb9b6d85e50f4f506e7c65222c
SHA1

f2ef73d4baaef3d3081e92efd7c748595dedad55
SHA256

438d6c2d58ecf3acd3ad86b69b17519824a5b51a51698fa48507494c27570859
SHA512

c880cbc1633b2eafb2235b0d8ec6322c10f5a66867e1b2018499614acfb9c170e9f2d35e76d9c7b637d26be10c3543ed3e62c71cf526758784d592c00edfae31
SSDEEP

393216:oedpFDl0qmjH67roK/2FCvdTjS5Do2Qx79VXzh3QQ00U64:xpFDCqmjHe2FCvdnsDMZVhCXx

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1128	7zFM.exe
Token: 35	1128	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1128	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\S0FTWARE.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads