b29ef42de1c3466f80c4f46b198d2f744a5938dca50c073e171da9bef538a96f | Triage

Analysis

max time kernel
93s
max time network
144s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07/02/2025, 06:37

Sharing

Report Analysis Logs

General

Target

Night Mev.rar
Size

8.4MB
MD5

f1ffa4e56a276f6224015b22bd70c043
SHA1

54103ceba0c49e81312dbf18dbb02976783cf953
SHA256

b29ef42de1c3466f80c4f46b198d2f744a5938dca50c073e171da9bef538a96f
SHA512

4075ef8c7f0f2ec9caa5d141b080efd639a52f1326243e254ef1e40d79ee6afdd45e982f89bbf2f81b9cfe6cf10f3aa9e651106ef4f700980521286f258bed12
SSDEEP

196608:wv+F4MFoZk04uFZnlCKNb7KhkrlDzBm8tIAYrfrajFsXi2tRI/:VWMCk03FZlCK1akBU8t1YrYH2tI

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	240	7zFM.exe
Token: 35	240	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
240	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Night Mev.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads