b99fa29a917eb26f7dd60427f9d4e261e95e06354e570b0e7f7c759672b9ebe7 | Triage

Analysis

max time kernel
139s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 13:39

Sharing

Report Analysis Logs

General

Target

data-Setup.7z
Size

116.3MB
MD5

3152ed0815d3eb095c6e9c8469d99b77
SHA1

addf193abcafc1d6099b787ae7be873c79b4f365
SHA256

b99fa29a917eb26f7dd60427f9d4e261e95e06354e570b0e7f7c759672b9ebe7
SHA512

b7eae4d1cd9c6c3edce37f2601e1f3528689d459c1780558a17ccaa770d189f6413f6b51105dac595d3afb9d95a28c24b7e5a7d0bdcdfd3cb1788fe672e918b4
SSDEEP

3145728:+bjzx3kP0uuE0SWwn8lkUXljGeHS4RG9MGbVOKHntLCJCIXrd:Yz9kP0ut0Pwno1jGeySG9JVgJCIXrd

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4156	7zFM.exe
Token: 35	4156	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4156	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\data-Setup.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads