Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-11-2024 14:53
General
-
Target
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.tar.CAB.tar
-
Size
4.7MB
-
MD5
4ace9e277ab91bd277dff9e307b62fea
-
SHA1
57c42e34b6b5720b81803ac9264a6513a8fdb7eb
-
SHA256
7f9a123bb49847daf175378a4730c7c594342693b95473a1dc3f64c7cb14a553
-
SHA512
bbaf6443370437142dcdecd1cc752145e524ae73c04362237d2cd54354bbe3643366003b678a0fcea94e66a3e7b2afebd990cf1b41447e15be02a6669ef1854a
-
SSDEEP
98304:SbaMbXbE/I/SnwrQEQusdI66l2u45UNYFrkvz29kdJcckh/AIo7:gbrprRNkI6w2u45UNSwvz1JcLd
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO.tar.CAB.tar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow