5fab2b5a50f8f9432a51f9e9538b1151d6cff93a2744144a8e2263f7f462e231 | Triage

Analysis

max time kernel
91s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
14-12-2024 15:37

Sharing

Report Analysis Logs

General

Target

pago 4094.rar
Size

479KB
MD5

a448bda0002ecd968b6ae9526617c974
SHA1

cf13df73eff74b9ceb6d837c1d7cc9d01fe918db
SHA256

ad24b345eac9876a65fb6b0d2eda0da669c3b23aaa969db9ce913f8a63c0a5f1
SHA512

2f819a259e875183db1fd4357f94296352f2953a1c1536459d6df625222c19feaa392ccd8d9c3b4051960b5c1095bd06e8f8315b6882ae150f99b813fee83dc2
SSDEEP

12288:FlVvIQalIT28m/A4CAa0nuRG4XYB5pYGCP5G:Fl5nalyGzBuk4IB5pY7G

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2028	7zFM.exe
Token: 35	2028	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\pago 4094.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads