c21127aadac9b81dd678971dc27c4bcace5682fa2c8fe08caade0a75cf464d21 | Triage

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 14:00

Sharing

Report Analysis Logs

General

Target

xera.rar
Size

3.1MB
MD5

b7b51c74ed6ac2f98b59c93b709c190b
SHA1

6904c888c8467d6d39ccccddcff053769b7d38b3
SHA256

c21127aadac9b81dd678971dc27c4bcace5682fa2c8fe08caade0a75cf464d21
SHA512

906431208a9a5eda48ea59f88c44281713c23db657d173322101a8ef914ad9cf39b22d43d2335a901fe90258d37a75f3f97e1de95e06751c81cfec2d4740016d
SSDEEP

98304:Y+JNTHI2F613L+wtrsmyVBF/nhk0Y41fHMQCgoN:Y+zt6NH5smyRP5YWsQCgoN

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	640	7zFM.exe
Token: 35	640	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
640	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xera.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads