7d33d73375c0b6e3661ae0377aa26648ff1d836602dc8a9c6bbe6e044cffe287 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 16:44

Sharing

Report Analysis Logs

General

Target

FACTURAS ADVISES-AIRE.7z
Size

13.5MB
MD5

8e758679157b1d4e5cb177b2471480fb
SHA1

23ad0202d93641477b10a2dc5832d73aec8805f5
SHA256

5c76378b5aa0473f02680e12749c339a2d6206aa9a17aec54519261aae2575b1
SHA512

338e30719739ce692212466362a6784e5810f24dfa753ffb5ca1360258de89b3d468a082a6553ec924c112534d7b1990700b94a6b2c5d98e84ed056659d66377
SSDEEP

393216:i6tH/RFvHx+zfBytLLZ0nQh57ZNMH3Y/8mWB2q:ZtH/RZEu+q5dNuo/8Nsq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1272	7zFM.exe
Token: 35	1272	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1272	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURAS ADVISES-AIRE.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads