70330c357e3752604f59bfd661478bd6d8d114dde53e48b1ad13396adfec346b | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2025, 16:44

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

102.0MB
MD5

0a6c656cb0c0e78ed325babd304409cc
SHA1

366e38c262b6a418546aabe8b9cde030419434e0
SHA256

efbd575c57021b5480dbb27bba6f3cf6e6b008b44638016adc121801fd8f615a
SHA512

7abf6d44c6cc31cc4ac0963c46ac1f6a6cfcb0742ae351821e2af3d04573083b4c9b75f23091c9509e3f45346bf6d05fd24267e271cee6708c03d37435ba3100
SSDEEP

3145728:fw4Mlb52h3yslb52h3yikWOvEVlDOZB931nMhAnvr8g6V:fw9t52hJt52hQWOJZB93lcAnQV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3920	7zFM.exe
Token: 35	3920	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3920	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads