Analysis
- user interaction
yes - max time kernel
62s - max time network
64s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-fr - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-frlocale:fr-fros:windows10-ltsc_2021-x64systemwindows - submitted
22/04/2026, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
Nouveau Archive WinRAR.rar
Resource
win10ltsc2021-20260130-fr
3 signatures
900 seconds
General
- Target Nouveau Archive WinRAR.rar
- Size 23KB
- Sample260422-s6dxfset91
- SHA256 2f7b0501dc06dad994805632b5e4cb9e1792654940bfe3b60d5b7aca33ab1f6c
- MD5 d906c2b22d9919a2c2fd4a5cee9e35d3
- SHA1 89df739db2ea55be086fc838ac4983a74cb38c51
- SHA512 c179e00757e17af820aabe056513e2d8e94a5f5cf7380a6a9b0534ef08c245dc72893da1cbe8f8b4e817e7971e02d404d6aa73aeb678fff0d922852e40e56da9
- SSDEEP 384:DwBFhT+IGXPP32FEnwxGFqqkVPk0p1MQo0j5OO2H/8Q/IlQyXg7vz2RvfRtwz0Lx:DwBTiP4ewEVmPlLMQo0jH+t/Il7Xg7vO
- TLSH T122B2DF2D7D109E23C54070BFF4E47675238CE63615AE0E626E3A48C27C860BD6ADB30E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3092 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3092 7zFM.exe Token: 35 3092 7zFM.exe Token: SeSecurityPrivilege 3092 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3092 7zFM.exe 3092 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nouveau Archive WinRAR.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2692