7f7322dad291e09fdc27a7ae31e1c3a957660311b8dea3908bfe2b10a6969ffb

Analysis

user interaction
yes
max time kernel
102s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lilith_rbx_external.rar
Size 5.6MB
Sample260511-pahzrag15w
SHA256 7f7322dad291e09fdc27a7ae31e1c3a957660311b8dea3908bfe2b10a6969ffb
MD5 efb2df880de17801a2044abbd382c748
SHA1 85b3cfed4f01c2673eb11525f0f44983a45b22dc
SHA512 61b8c4312f8c11a67fcca2c827639ebbb993adc95680343d6b24c4482fb6e40efce3adcc5e6a596898522a47bd8301bcd560616d5e8c6e4f8bc3113453b83f16
SSDEEP 98304:z1KNZcMnFO2SeBVN0iJEkG9eEf8Ez6gGtynLas9dQKpbmp:xecMo2SeObXeFEz6ltaLH9dQKhmp
TLSH
T13D563339A2BDDA051D7598E507458440EC76A38AE73CDDDB076580F0FC8467CAAEA0EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.cpp	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.cpp\ = "cpp_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\cpp_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\cpp_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\cpp_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\cpp_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\cpp_auto_file\shell\open\command\ = "\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\""	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4924	7zFM.exe
3868	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4924	7zFM.exe
Token: 35	4924	7zFM.exe
Token: SeSecurityPrivilege	4924	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4924	7zFM.exe
4924	7zFM.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1512	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
3868	OpenWith.exe
5452	WORDPAD.EXE
5452	WORDPAD.EXE
5452	WORDPAD.EXE
5452	WORDPAD.EXE
5452	WORDPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 5452	3868	OpenWith.exe	100

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\lilith_rbx_external.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\zzzz\main.cpp"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

main.cpp

Path C:\Users\Admin\Desktop\zzzz\main.cpp
Size 3KB
SHA256 484f5a7eb6c1daa6a035c4f1f5620cb0beb8b7a8b3aaee71844e89cfbc4154c5
MD5 d8ab380198e7e762795d9c01e7970fcf
SHA1 accfbb9a34efcaef45896ac173944ea9fc9c79bb
SHA512 fe43200808c951b5bc7fc58e810db3893138a3b4187e79eec6ec58386e47cd0bf91bd47550ebda10233e9d4682276473f13e84664c76f4f5ce62d7485e958eca
TLSH
T1B66163823D7F718EA5739808E1312902DD5FE9A207D7976BF0C8D209B50D44A93F59AF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1512-492-0x0000021BB4830000-0x0000021BB48D9000-memory.dmp

Download

memory/2444-498-0x000001E8C9480000-0x000001E8C9529000-memory.dmp

Download

memory/3868-495-0x000001C0693E0000-0x000001C069489000-memory.dmp

Download

memory/4924-0-0x000001E7876C0000-0x000001E787769000-memory.dmp

Download

memory/5452-496-0x000002AECBE30000-0x000002AECBED9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads