Overview
overview
8Static
static
15769be09-a...e8.eml
windows10-2004-x64
15769be09-a...e8.eml
windows11-ltsc_2024-x64
8email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1oneoffice....xml.gz
windows10-2004-x64
1oneoffice....xml.gz
windows11-ltsc_2024-x64
4oneoffice....03.xml
windows10-2004-x64
3oneoffice....03.xml
windows11-ltsc_2024-x64
8Analysis
- max time kernel
598s - max time network
562s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
5769be09-a1c4-99b2-46cd-2263f070a0e8.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
5769be09-a1c4-99b2-46cd-2263f070a0e8.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
email-plain-1.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
oneoffice.jp!adventus.com!1785855603!1785942003.xml.gz
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
oneoffice.jp!adventus.com!1785855603!1785942003.xml.gz
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
oneoffice.jp!adventus.com!1785855603!1785942003.xml
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
oneoffice.jp!adventus.com!1785855603!1785942003.xml
Resource
win11ltsc2024-20260709-en
General
- Target oneoffice.jp!adventus.com!1785855603!1785942003.xml.gz
- Size 593B
- Sample260808-rtpyhsyclc
- SHA256 18c0191e7051546ffb5b2e8d1e17c71505fe2e17083e12d85b7377bd8227e5c6
- MD5 0e45dba6a20c2349c90785744c05f2ee
- SHA1 3fc179e5d54677abb6add9c3079e87b7f3da8dd9
- SHA512 eee6b51c3939239b00d971ca9b2a2e366929e7e43a007fe3be2121fa41b9d81e83e935d5ce554ec204a150c68739cf85e721224face29bbf13cac09e87f26f71
- TLSH T112F002EE115991A5DFF850B224400B45396907B467F10C0A3431D5EC6DC664199824DE
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1760 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1760 7zFM.exe Token: 35 1760 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 7zFM.exe