ca5a0e2963dc959524712f6d71b937d20a2bf15a4fece708ede9a84b50bb2ebf | Triage

Analysis

max time kernel
57s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 10:09

Sharing

Report Analysis Logs

General

Target

FACTURA_240001920.zip
Size

519KB
MD5

f1fc58a97fc3f2502b7cdd0d046ecf81
SHA1

02c028d780a63ccdd20b68cef08b6fa045cda1e3
SHA256

ca5a0e2963dc959524712f6d71b937d20a2bf15a4fece708ede9a84b50bb2ebf
SHA512

cd5ac2f3c35672aacd2916b2619099b32977c51263791c8e36f120ab69f3d9f4d79ba042377b046fc0e6466c48d29fd809566360086f8585cc726f1b4f40948d
SSDEEP

12288:ATnVHUif59VXBKLDCyNJV3g3p5EpwdOyPC:AFP5rBKHy51x6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2216	7zFM.exe
Token: 35	2216	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA_240001920.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads