48fe545d10166c4aea48252deab4a043abd56b758aed8439a5f1479d18ae6944 | Triage

Resubmissions

31/12/2024, 03:26

241231-dzfp5ssjer 7

31/12/2024, 03:23

241231-dxrpmavmfy 7

31/12/2024, 03:22

241231-dxckps1rgj 7

31/12/2024, 03:18

241231-dt4j1s1qgj 7

Analysis

max time kernel
435s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2024, 03:23

Sharing

Report Analysis Logs

General

Target

Nueva carpeta.rar
Size

27.1MB
MD5

6e078e2e9289d78f4660f36d65c9327f
SHA1

9c20e120ea4e2c3cd19df50cee05b839c42e547a
SHA256

48fe545d10166c4aea48252deab4a043abd56b758aed8439a5f1479d18ae6944
SHA512

b6f8550d7064519dd7487bade6fb7f9ea68e0c6786e17a74c285553327c18ab6663a069b692890747e99e29fb952c70e8ff3ea13c491d8747d5dbb1e26f60f3f
SSDEEP

786432:GLcIo8H4RQLIQxYF6Zbq0QSNrjM0qzcFrS0Q4puKS5nWhh:j8YRQLfxYF8e0QSNkN6FQ4AKrhh

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2872	7zFM.exe
Token: 35	2872	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nueva carpeta.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads