b29ef42de1c3466f80c4f46b198d2f744a5938dca50c073e171da9bef538a96f | Triage

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2025, 06:35

Sharing

Report Analysis Logs

General

Target

Night Mev.rar
Size

8.4MB
MD5

f1ffa4e56a276f6224015b22bd70c043
SHA1

54103ceba0c49e81312dbf18dbb02976783cf953
SHA256

b29ef42de1c3466f80c4f46b198d2f744a5938dca50c073e171da9bef538a96f
SHA512

4075ef8c7f0f2ec9caa5d141b080efd639a52f1326243e254ef1e40d79ee6afdd45e982f89bbf2f81b9cfe6cf10f3aa9e651106ef4f700980521286f258bed12
SSDEEP

196608:wv+F4MFoZk04uFZnlCKNb7KhkrlDzBm8tIAYrfrajFsXi2tRI/:VWMCk03FZlCK1akBU8t1YrYH2tI

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1016	7zFM.exe
Token: 35	1016	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Night Mev.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads