49290f83b42d99c5314f8bf07479509cc69fbf20586c1e5826fc739e6ad0889a | Triage

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2025, 06:15

Sharing

Report Analysis Logs

General

Target

netstat.gz
Size

4.3MB
MD5

bed4d8947235ab7d8cb3ca8f1907d703
SHA1

5694600d22a830f3fffdd18b82500c9b0ddab385
SHA256

92871df5031884ded319b31ff8e4c855f4ddf60118361c8bc1dd411a6a92e2d3
SHA512

83422506aca00ab2e13cf43ef099ec5bf5d03b6a1266e51d47e2885410766c05ef2200e759ec76e7130a57c74b23986b71e39b22deea1d7793dd5145cd9e3750
SSDEEP

98304:g+jsMvRICPdDkXLmRRLJcXGMwHnm7EHfo2pAPXL2VVlMYt:BYkRF4X6RRLKXGtHmIbpcyVVv

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3036	7zFM.exe
Token: 35	3036	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\netstat.gz"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads