14f521f5a884d7fda7c5844fd2893334386f28a815925fe1f1d5ec24915140de

Analysis

max time kernel
149s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_66bcf9fd1d3592075ec2c1f4e73d1c6c_elex_mimic_pay2key_wannacry.exe
Size 8.5MB
Sample260527-vehsfaft7y
SHA256 14f521f5a884d7fda7c5844fd2893334386f28a815925fe1f1d5ec24915140de
MD5 66bcf9fd1d3592075ec2c1f4e73d1c6c
SHA1 5ef20bf03a8518b08be9dd9587c298b117972902
SHA512 3194da58a2cf89233ea5e157024ea3f535402e1461a7836f40fc566a5fc91bd0de41a76205224522cba5614d0f978ad95d60f003329b0ab64cfaca98cfe24226
SSDEEP 196608:7gEbijeHfEdOLnPJRkveQ0vG3D69TtTXIiGhBG4/Xn/frL:7gUij6LnPJRkveD+ePYiGhBR/XnX/
TLSH
T1AB9633073FD706B9D9941533CC95A9E9F9F8E9380B18C0CB16720E2B9DB0590567A3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/2300-0-0x0000000000400000-0x000000000042B000-memory.dmp	UPX
behavioral2/memory/2300-284-0x0000000000400000-0x000000000042B000-memory.dmp	UPX

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
2160	x64.exe
5000	7z2408-x64.exe
464	xDark.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2300-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/2300-284-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File created	C:\Program Files\7-Zip\7zDark.ini	xDark.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	xDark.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	xDark.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	xDark.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_66bcf9fd1d3592075ec2c1f4e73d1c6c_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xDark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip\ = "7-Zip.gzip"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tpz\ = "7-Zip.tpz"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.deb\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.wim\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swm\ = "7-Zip.swm"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gz\ = "gz Archive"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.swm\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.swm\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tar\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,13"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.taz\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.dmg\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.lzh\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.taz\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tpz	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tpz\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "7-Zip.tar"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.cab\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tgz\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.wim\ = "wim Archive"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.wim\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.7z\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.split\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tbz2\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.z\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmg\ = "7-Zip.dmg"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.hfs\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.rpm\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tpz\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,14"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.z\ = "z Archive"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.dmg\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,17"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tgz\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tpz\ = "tpz Archive"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tbz\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.cpio\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gz\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,14"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tbz2\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.wim\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.deb	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "7-Zip.z"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.bz2	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.cpio\shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.7z\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.bz2\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.dmg\ = "dmg Archive"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.split\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tbz2\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.zip\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzma\ = "7-Zip.lzma"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gzip\ = "gzip Archive"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.cab	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.7z\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.deb	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.xar\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.cab\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2736	regedit.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2160	2300	2026-05-27_66bcf9fd1d3592075ec2c1f4e73d1c6c_elex_mimic_pay2key_wannacry.exe	80
PID 2160 wrote to memory of 4812	2160	x64.exe	81
PID 4812 wrote to memory of 5000	4812	cmd.exe	83
PID 4812 wrote to memory of 464	4812	cmd.exe	84
PID 4812 wrote to memory of 2736	4812	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-27_66bcf9fd1d3592075ec2c1f4e73d1c6c_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_66bcf9fd1d3592075ec2c1f4e73d1c6c_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x64.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x64.exe" /S
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\@echo off.cmd" "/S""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\7z2408-x64.exe
      7z2408-x64.exe /S
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\xDark.exe
      xDark.exe /S
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:464
  - - C:\Windows\SysWOW64\regedit.exe
      Regedit.exe /s 7zipFileAssoc.reg
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Runs .reg file with regedit
      PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.chm

Path C:\Program Files\7-Zip\7-zip.chm
Size 117KB
SHA256 f830ddc5280d00e1cb160f9e5dd114292d5efef66c23c3c03c224894250bac2f
MD5 99b88f4d6d13713053db06b449ed6a9f
SHA1 f718e09a42e9ec49db060589d24135ca6929e8e0
SHA512 9f1cb9ad8023b340c82e987bab33cddd817e3ece892aca7350650343396d4dc5d00cfd99c0718a862280c81d7d525c5e870390e1cdfdb4987b6663b1394cf1fc
SSDEEP 3072:LbVXJ5WfBbkivVIdgKd07cleTTsM7YISV0ifmMz7:fZeBb1V0gZ7cloz+d
TLSH
T113C302986B1D0241DEC404F4061FEA68BA9AF7B248C9E5ACF36F1ADC85FC32E5C514E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 99KB
SHA256 f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902
MD5 d346530e648e15887ae88ea34c82efc9
SHA1 5644d95910852e50a4b42375bddfef05f6b3490f
SHA512 62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673
SSDEEP 1536:mCkXPxYbAVFYytdtXD571K8XQui+aFBZxH3OwenyrKm5GDES575Y+NPyFG:dmxDF5tGVFBZxHeB46VYdG
TLSH
T1F6A3C625B664C335D073D0BAC9C2AA99EA7178419F304BCF6246A74D1E36BDACC35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip32.dll

Path C:\Program Files\7-Zip\7-zip32.dll
Size 65KB
SHA256 96313194a8ace0d6fbe037dde8c85d1430a5fb1d8cc62e68bdf41fe2e838f440
MD5 82e994d93bd2eed9ec406e81c27542b7
SHA1 f7b4a033baa1cdb812d8d606535bc04aca264beb
SHA512 993f86492114029186656cee385b9639efde6f3c3d6ad853413a7f187f65c938a44665aee98f01e206388ff1f68979f16cf0edebc298cb34bbb183ad048741b4
SSDEEP 1536:Cx241Eg3LbDGNmS+FVsaWsEx7ce3RQQd/YsJy:k2Bg3LGNmSSsaWsuz/Ysw
TLSH
T137635A0336E4C9B8E29D2234EE99EBB540F9BC299DD1858737903B9E1E329D7C205617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 4.0MB
SHA256 bddccb3fe04484ee467a3b95baadcbcd9c99f9f6ec75bd3858a1ac5d50cf72e7
MD5 a978a46b0837471e8d9f7a1ec82c440d
SHA1 ff94595a59c2377e8e17301baf6ca4928d25946b
SHA512 aedfee688b4de37d3568ecdb2e628fa5d81c18db8cfc2661953877f58a063bcf37d28cfbef60547539aa790d2df060fb9fcff96dee6d6c17777860b567ebbbb0
SSDEEP 24576:p0Imsn0YfdAVEn5al6CZLQoOGHh2dDmp74jAG/aH1ZvdpW8Me/:T0YFAinktZnOe2S4T/c17pW8Me
TLSH
T123166C965348A88FC45332F1946B87F3BA916F1DA1B16522A7B07F84B935027FC2172F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 549KB
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.sfx

Path C:\Program Files\7-Zip\7z.sfx
Size 210KB
SHA256 6b57604755bd4410a4f1adbce90498e205f4255c5786d5c4ddb34327c161b125
MD5 2da1e169833d1ac3697ded688d0c5a11
SHA1 59937a1f6c4c2b67870a9d5eff222fef230994cc
SHA512 9324e6428cc92ef928ccc730eda904559c1e6dfecfb79e5e6961b4f129e9ea3accad96e725cb9edad05ed82467c5c72cba7f284d295de19854b711c89f6ad94f
SSDEEP 6144:oCtXnzXsyLVkjCFA3Kc6Gy33LaP4OSWA2:oCdzXsyLVkP56J33+4T2
TLSH
T104246A2137E1C9BBD253153199EC6BF6A1FAE7494F25888713C08F1E5E309E2D23962D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zCon.sfx

Path C:\Program Files\7-Zip\7zCon.sfx
Size 189KB
SHA256 062c989ac695cfafdb4c83a8517b2f6716e1a8a1255360f01a49216c4a21884b
MD5 dd69f1774b4a3feef30e5923f846fba7
SHA1 9c31dc7109a1051faa0253e0b666faa0ebbfa66f
SHA512 6afa3746630ca882bce8410e76cd3e3e0acc5662d48be6c8d54577a0a3d836446b041b1293567dbb357389967c9fa3a02bdf2be0dbb0142fbfa74d1be565cdcc
SSDEEP 3072:yzkUY17sFJxZt0rDvKTkafhGCvUkmmdB6JVFonVk4AOnLyiH2DddP:p6tGLqkOhdvUkmmv6JVFsTLyiHGd9
TLSH
T1B3147C2177E5C0BBC64321308EDCBBB9A1F997480F1549D323C49F2D6E35AE2963A52D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1017KB
SHA256 01f8e98fea3159438f633d055cc2ff4ac4a3f654c6455e7754961572b1ed97bf
MD5 e2fbe82c6d0c0e6b07845d868cc502da
SHA1 1d1052bc66c83a9ece60c5b3591bc0212142a7be
SHA512 c85aaed91d118da9b9d8bd01f3c2d28f41c15a1d9bd9bab6bc3cf6e3daa0fb3e76b6fa4c74254ff52b53e4443ffadffd8b866e848d4a96989e99ba3af87426a9
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 692KB
SHA256 0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101
MD5 4159ff3f09b72e504e25a5f3c7ed3a5b
SHA1 b79ab2c83803e1d6da1dcd902f41e45d6cd26346
SHA512 48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d
SSDEEP 12288:9VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:9VbqPb88hv/l+7
TLSH
T152E42A66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x64.exe
Size 4.6MB
SHA256 2f8b2ff0e357be61c209564d68e3601af48f52cd150d76897a06d24dc4c61afe
MD5 46d066a1a957bc0321c114a1f031e395
SHA1 980bdf4218e96d20a64a561441c2c60683227ed5
SHA512 99fedd9e0008802c96957c5199606d67836a53eb7683f0f7dc2129c18866a6962dd8f1cf8119fc13ac5a65d9a9081d82cfc9108e7be0d3f21148e056fcc8acec
SSDEEP 98304:ia1ocXUDHBr0OvpgDChGKhGArPR9KmZghcidUxqVB:X19UFr02bgKhGAN98civn
TLSH
T16D2633477A85D932E2246A71DC55B4F8AFB9FE29CC29C00B22F57E0F7D7115280292E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2408-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\7z2408-x64.exe
Size 1.5MB
SHA256 67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b
MD5 0330d0bd7341a9afe5b6d161b1ff4aa1
SHA1 86918e72f2e43c9c664c246e62b41452d662fbf3
SHA512 850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1
SSDEEP 24576:UEBmEo1y9fcw5K42KmEDaMYAhr08oSG4OdWrfjcaHSNXJdx7wE9iko6qzLJmYYUP:UEvoo24xV2JJdPwMJ3x75z5q0jc/3
TLSH
T1307533927C094177FA5942F1949BBDEEF8FCDD154CAC818D0BA10A6F98B5740827E2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zipFileAssoc.reg

Path C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\7zipFileAssoc.reg
Size 9KB
SHA256 9fe4a4c8b5771559ead07d3d49bf158930ab7130f49dfb80592c815973c7a9a9
MD5 7ff4de061d30bec54e6e96ca9b3f6095
SHA1 4b51e58ee3f52a631347281e303bc87b8da6e3ea
SHA512 72ed44f166501910fe847e9cd49d8f3968b21b540382211711d79e0dbdcb2113ff2e22bf7d696388083eaa5e8e4919e7fb5e0c4a6130cbda9330c167103d68df
SSDEEP 96:PSZF/xnBbTXQoZRM7EufhxcB5pDZitjH2v3j9J:PKZxnuMp/
TLSH
T1AE12B8724566C6983DA314200B54A7C993B8E56C66836FC5A1FAD38B3341EF704EC27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@echo off.cmd

Path C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\@echo off.cmd
Size 680B
SHA256 272714a4268feebe578eb1e711f218770b22c816ecb204a39f13424fa0d208b6
MD5 e14c132276ffba14b7d37fc86aef3e03
SHA1 ce1e08c5135654505e38ef38d389551238b25874
SHA512 d4619a8a583ff5ea69ec13750d028c2728e80ed7f2c7f8092143df9e6b08ea4d09ca137a541c33a65c4a9369cd2487d63fdbcf752dbc70f8e611dd2d2d3a1ecc
TLSH
T1DA01707741C34357EB042BA8126B185BC11ADB45E0407681F676377DCB76CA8517469F
MD5 SHA1 SHA512 TLSH

Submit Download

xDark.exe

Path C:\Users\Admin\AppData\Local\Temp\~sfx0051A02001\xDark.exe
Size 3.0MB
SHA256 0fdfa72bf2167be3d3b6174163985a44941fc8e96d884a3bf78aad4ff905059d
MD5 afec53280791426c356f43a4665a5215
SHA1 b0dea99fa3a23ade827ccb54813ad2a72005ab1c
SHA512 a85689a15abbd427ce51104a48d2e9572b2ead6724ff94065754bd07a55d08550410f94d3eb17bc31f175d1041cf0a35e5a1d999d3184590283863ec3dd0602e
SSDEEP 49152:UIfamFKDXGDWjvb+P+JFaV3bpQ2oJe2BCvEcJtZqOClUncvD/VvxujRcdgpdoZBa:izGev6PSFmVZiCvE7BLu7kZBa
TLSH
T13BE533023BC19836D4745D35F8EE9674DCB8FA3995129118A33B6C5B3DB0472D822BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-279-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2160-282-0x0000000000400000-0x0000000000E30000-memory.dmp

Download

memory/2300-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2300-284-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads