7d0911cf26b32b4b77de8072be5b2eeb6f5bbbe981933c5643a0dd596dc3358f

Analysis

user interaction
yes
max time kernel
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OceanWin Spoofer.rar
Size 35.0MB
Sample260621-ctrpsab181
SHA256 7d0911cf26b32b4b77de8072be5b2eeb6f5bbbe981933c5643a0dd596dc3358f
MD5 d311de1c6ae77891ba529b9198dbbc1a
SHA1 42a2d46934612857699e4b524c5341efacbd8e57
SHA512 7d805d6cd088f38f79b06bf62ccfb23835b4e106fe65cd956afafc0c9ada81fa219f3c246c037c119c487fa9874ca7f41f3385914ed1e990d890a77924e76c12
SSDEEP 786432:5Oudsi9/i79WKSbDYsIvxPRnGvWPFZ2Y/3f5/A36fIdlQ:5Os39/TDYRvxsvWPFQG3f5436fIdlQ
TLSH
T1BA87338D3824791F7656500A9C6C2390B82BD4EA77ECD76C89DAF4C08747BB148B7DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4616	XD.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4616	XD.exe
4616	XD.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4616	XD.exe
4616	XD.exe
4616	XD.exe
4616	XD.exe
4904	7zFM.exe
4904	7zFM.exe
4904	7zFM.exe
4904	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4904	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4904	7zFM.exe
Token: 35	4904	7zFM.exe
Token: SeSecurityPrivilege	4904	7zFM.exe
Token: SeDebugPrivilege	4616	XD.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4904	7zFM.exe
4904	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4616	4904	7zFM.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OceanWin Spoofer.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\7zO823E7BC8\XD.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO823E7BC8\XD.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

XD.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO823E7BC8\XD.exe
Size 13.8MB
SHA256 68756011ba8e14bef18e188b2a5f5dccbcb0d6c4aa552c99fcde41887f828175
MD5 6801fb25d54fd349f808761373217ab6
SHA1 3889ca95f780abb77d0655d2ec886f79169ba3f2
SHA512 e45418f75c6466ceb55a122c31563096f7e4f2a621976617c17099ecf9664a6cc53da398e745205d62633a53f396020e792863ed729f4bf46ae6d02fe932b3ee
SSDEEP 393216:ogJ1H45414sRe+kGt+vOX+UiywBDzHJki4:BLHGt+F+vlUi1HJO
TLSH
T19CE623D53EC6A26CC0B3CB14728A176970F2B7CDC1FE4E2E36C71C0266A1E579E5581A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4616-9-0x00007FF61384E000-0x00007FF613EF0000-memory.dmp

Download

memory/4616-11-0x00007FFB29640000-0x00007FFB29642000-memory.dmp

Download

memory/4616-10-0x00007FFB29630000-0x00007FFB29632000-memory.dmp

Download

memory/4616-12-0x00007FF613340000-0x00007FF614CB3000-memory.dmp

Download

memory/4616-13-0x00007FF613340000-0x00007FF614CB3000-memory.dmp

Download

memory/4616-16-0x00007FF61384E000-0x00007FF613EF0000-memory.dmp

Download

memory/4616-18-0x00007FF613340000-0x00007FF614CB3000-memory.dmp

Download

memory/4904-17-0x000002AEA56B0000-0x000002AEA572C000-memory.dmp

Download