5fab2b5a50f8f9432a51f9e9538b1151d6cff93a2744144a8e2263f7f462e231 | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
14-12-2024 15:37

Sharing

Report Analysis Logs

General

Target

1_email.zip
Size

509KB
MD5

d7e0b9f679bafc78cf5aadd5c3480545
SHA1

185bf43e476b4027492ace2b73d69cf0eb1ea875
SHA256

5fab2b5a50f8f9432a51f9e9538b1151d6cff93a2744144a8e2263f7f462e231
SHA512

a76d9f17434f56e51fa33cd0498d4dafc4fc348b2fa19fc5d919f2173fd38651c3ec47c2380d95fb723e43a3f64459e19c3e2e3414cd08c49f3911d3e0d17a7d
SSDEEP

12288:XnLaBzLTZGXZ+mStdggO7N0nTuL33nkXvICwCkcw6MOIMJ:36rZGotd1KN0n3HnMOr

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2744	7zFM.exe
Token: 35	2744	7zFM.exe
Token: SeSecurityPrivilege	2744	7zFM.exe
Token: SeSecurityPrivilege	2744	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2744	7zFM.exe
2744	7zFM.exe
2744	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\1_email.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads