Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 02:20
Behavioral task
behavioral1
Sample
cc9517aafb58279091ac17533293edc1.7z
Resource
win10v2004-20260130-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc9517aafb58279091ac17533293edc1.7z
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target cc9517aafb58279091ac17533293edc1.7z
- Size 53KB
- Sample260426-csfacses9n
- SHA256 59ebe6d09187c8d5ccf9cbd98811d33c0be03dea6b5d72093f32f6a6eb7abce8
- MD5 2caeefc448ee4e3243f12cb75d8cd856
- SHA1 5dfc256649fcdbd8d756daa76ef0dccfcf06f2c9
- SHA512 e5e928159c66f90d5c23729941406f1c8ef2cb01774e0b660c438c28a94d074f392b7a8bcb889cd8e4ec6fb95137928c5faddcc7d96b705bc1dcf19b46388c92
- SSDEEP 1536:tkgCd5nQUQtslV+iqt6z+Y5npWMnKK97pGPPUf:zCnnQTE+hsaY58LKFpGU
- TLSH T1E1430266BEAD5152E9279710A232413A47E9635DC87CFACBBB0D238C341E9DE105902B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4508 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4508 7zFM.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 4508 7zFM.exe Token: 35 4508 7zFM.exe Token: SeSecurityPrivilege 4508 7zFM.exe Token: SeSecurityPrivilege 4508 7zFM.exe Token: SeSecurityPrivilege 4508 7zFM.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4508 7zFM.exe 4508 7zFM.exe 4508 7zFM.exe 4508 7zFM.exe 4508 7zFM.exe