1a09dc33b327233b2aa4cfddd0379600153e8d2ccb89b70de1336f1bc2c93c49 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 19:08

Sharing

Report Analysis Logs

General

Target

xlwings-0.31.10-cp38-cp38-win_amd64.zip
Size

1.6MB
MD5

6bcbcd7db01582157ef54b447c02f5c2
SHA1

1edcb95f79687f07fb2f7241a8de738a8b130077
SHA256

1a09dc33b327233b2aa4cfddd0379600153e8d2ccb89b70de1336f1bc2c93c49
SHA512

a11dca905e327e5de9dd3db7f3b4c11b68e5163a122a2978d4e293408c5ab3d06f0395e0556b58770af324baf65d0f9a8da5da18e76c9906a0b46a89502f348a
SSDEEP

49152:NnSBbSGU0rRrCySLz4HydDzKPXOPUYrSsK:EBy0lrBSmyx7PUYjK

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2772	7zFM.exe
Token: 35	2772	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xlwings-0.31.10-cp38-cp38-win_amd64.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads