c9b997cf25b9fb44813f425c407c4df2b23c90a3437c600f28da6fbbe46b3584

Analysis

user interaction
yes
max time kernel
65s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 21:55

Target
Grounded_Fix_Repair_Steam_V4_Generic.rar
Size 22.2MB
Sample260623-1sxfmsgw9v
SHA256 c9b997cf25b9fb44813f425c407c4df2b23c90a3437c600f28da6fbbe46b3584
MD5 68e0b7c0d14aa55c1960c90a894b2dfa
SHA1 50266a3d46f45c5d10394459bd531c3ec8dcb7f3
SHA512 8522440a7a28d75372f20cc770ca78ec35b3536c4c8715877f93ec6efa893985adf368fb997f5333136618a6c766f31388a77aeb6b448e18d2d81626be03ecf7
SSDEEP 393216:/xNHTkRtFcNygNOIghbYQRS8xgVP+hX/rmqUqU4SiY5q1mdOb+:/LzifcNyKOIgbYcSqgqXDP3x7MdOb+
TLSH
T1C637337AC72F34A2E3279893A0454FDB4639CD80D39DAD99A4FA2B58854302F77E1371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1996	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	7zFM.exe
1948	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 5 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1996	1948	7zFM.exe	96

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Grounded_Fix_Repair_Steam_V4_Generic.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC9708918\version.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1996

version.txt

Path C:\Users\Admin\AppData\Local\Temp\7zOC9708918\version.txt
Size 1KB
SHA256 fc8d1b000c5df11ca7934419ca62883cb3f85d0c95f06d1d69eb77b517009a7f
MD5 4b879e198af008e64199c2e317892ed5
SHA1 daeabbc8bb3a08ed91158cfd92e056d3d52374f9
SHA512 d60f17300ca62cec9383e150f87ab5a48829893dab37bea88c7a1022dcc16ba208418e4f54551a1ed3dfc84ccaab9108f35233da09a5d2760d369f39e4b3d067
TLSH
T1EF21820A95F73298E0A7E6895EEA8D3207577D11443E9A1E99CC7E5D0FC34042512BF7
MD5 SHA1 SHA512 TLSH

Submit Download