de0e87ea9f7ee661dfb6e50ec37a5e62106a44c6b7a43d0719bb2cc1131ac3d7

Analysis

user interaction
yes
max time kernel
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 12:18

Target
BROOTH EXTERNAL V2.7.rar
Size 11.7MB
Sample260620-pg3bzags8s
SHA256 de0e87ea9f7ee661dfb6e50ec37a5e62106a44c6b7a43d0719bb2cc1131ac3d7
MD5 90ecafff4fcd9d24cd3543010d40c02c
SHA1 ccb498f64776e7267dd98fee460e8ec253c63ad0
SHA512 b3dacb08a98dbb034315f1f34e32e2bf898d676aa04690bfa0532464e0917cfcb18ff8f6e722f66c854f5c43f7af5cd97d57b547e71e6b1ce7bc6f9190b7d6af
SSDEEP 196608:fHPPcj1YXBC79ial4cXjuSo5nG89eA0lnpzElaXf/KI+BSwZBgTHJn5+yVtO4CVm:nP61YXPal4cXjvotGrhlnpzE2ESwZGJV
TLSH
T168C633973A407052E5C3AC20C31BF2057CB13A876E1AEDB953E2B93594C70A6BF54ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
6536	BROOTH EXTERNAL V2.7.exe
2464	BROOTH EXTERNAL V2.7.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5780	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 6536	5780	7zFM.exe	90
PID 5780 wrote to memory of 2464	5780	7zFM.exe	91

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BROOTH EXTERNAL V2.7.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\7zO49679A38\BROOTH EXTERNAL V2.7.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO49679A38\BROOTH EXTERNAL V2.7.exe"
  2⤵
  - Executes dropped EXE
  PID:6536
- C:\Users\Admin\AppData\Local\Temp\7zO496729C8\BROOTH EXTERNAL V2.7.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO496729C8\BROOTH EXTERNAL V2.7.exe"
  2⤵
  - Executes dropped EXE
  PID:2464

BROOTH EXTERNAL V2.7.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO49679A38\BROOTH EXTERNAL V2.7.exe
Size 13.1MB
SHA256 99f44ec8354bb8c89755a66914415e1d39be0cd60d1dc53a4338c997bd7f43fd
MD5 af4abe74646dfa2625943b2b8dffcfb5
SHA1 cd9bd8a1210e8fe987045902ab4c83b612781248
SHA512 5d103d9bfa99b63865418a3bbeb0d88fbf01eabdd5bdcad52367319cc960bc4a3167ff7b2adbfcea03fd3746a9fa881725efbaa1fc3adfce71b4d9e6b87d1b47
SSDEEP 196608:ZNlIQIqBGLlsidH0EM3EEilma80eX7tlTJCgFkgDF/6ZtPx6aWVnVkALVE1b26R:Z/DBGmidUEM72XPw85NZRxsVkiV
TLSH
T13ED623DB99C873D4C8D34AB0625F17CE70E1B5298DA9A92D37C61C42AE30FA74342D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download