Overview
overview
10Static
static
5AWB GUÍA ...MS.exe
windows7-x64
10AWB GUÍA ...MS.exe
windows10-2004-x64
10GUÍA AÉR...MS.exe
windows7-x64
10GUÍA AÉR...MS.exe
windows10-2004-x64
10GUÍA AÉR...06.rar
windows7-x64
1GUÍA AÉR...06.rar
windows10-2004-x64
1GUÍA AÉR...06.exe
windows7-x64
5GUÍA AÉR...06.exe
windows10-2004-x64
5Analysis
- max time kernel
121s - max time network
126s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/01/2025, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
AWB GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
AWB GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
GUÍA AÉREA 5526456806.rar
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
GUÍA AÉREA 5526456806.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
GUÍA AÉREA 5526456806.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
GUÍA AÉREA 5526456806.exe
Resource
win10v2004-20241007-en
General
- Target GUÍA AÉREA 5526456806.rar
- Size 666KB
- Sample250122-ms56wstjfl
- SHA256 1ccd9f18aa34d71dcfb2e4d488de0952cf165080a63e20f3cc097158667e6bbd
- MD5 10645dfbad205e839fe7e929b2d887de
- SHA1 47c5b65c641d6c914e64b404c6a98435efa71198
- SHA512 0877fbe7a5141ea040d95ecc867e984b6f4ee0e4952184b9c9bcceb50fd0b1c5ef0c3176afe4bb253d16ec38ba97c415cec6e62c0f094ff74601cf457b163d91
- SSDEEP 12288:TRknDaWWW3v4MlcT5I+SO/wRGVhTeUko7hRv3y+y5zZrLuGlJp:TRknDaW3gNO+T4RGVhSUn7vv3fC9rLB3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3000 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3000 7zFM.exe Token: 35 3000 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 7zFM.exe