Analysis
- user interaction
yes - max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/06/2026, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Yeni WinRAR arşivi (2).rar
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Yeni WinRAR arşivi (2).rar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
emu.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
emu.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target Yeni WinRAR arşivi (2).rar
- Size 432KB
- Sample260624-yz8fdaft7w
- SHA256 0ef72f15abf0b1139bfcc90a45fa80d27a6df72db763b54ca9262864a27e38b3
- MD5 615c947b1126d18ce28560cf0c93eb17
- SHA1 7b7f556797801d383f22ed0f72e0a5bcb029cf85
- SHA512 320cdbf3b7afd6c28e6fd6e8490e0ee08c8fd5de05cffc02e1178849e0c4380a170e8a0a47bd1751afd52fa7ec07a4a161480241918efbd620c63a7821c0d28a
- SSDEEP 6144:np6jJa7uNlkc5tmRVKwzGIIk22UUYhceiwvwEG24OoHAYiXWZbxIEOoRMxQ3MTWh:gaCX5o9GIpGiwPdvWArWFOoCQHw/K
- TLSH T1D594237F4CF4C24D576DBC7A8C58621B669DED8764414B8333AA923E677889D30F3888
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3808 emu.exe - Stops running service(s) 4 TTPs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5032 sc.exe 1456 sc.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe 3808 emu.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2016 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2016 7zFM.exe Token: 35 2016 7zFM.exe Token: SeSecurityPrivilege 2016 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2016 7zFM.exe 2016 7zFM.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2016 wrote to memory of 3808 2016 7zFM.exe 88 PID 3808 wrote to memory of 3088 3808 emu.exe 90 PID 3088 wrote to memory of 5032 3088 cmd.exe 91 PID 3808 wrote to memory of 1752 3808 emu.exe 92 PID 1752 wrote to memory of 1456 1752 cmd.exe 93
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Yeni WinRAR arşivi (2).rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7zO0E741CD8\emu.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E741CD8\emu.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\system32\sc.exesc stop vgc4⤵
- Launches sc.exe
PID:5032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\sc.exesc start vgc4⤵
- Launches sc.exe
PID:1456
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7zO0E741CD8\emu.exe
- Size 1.6MB
- SHA256 2d08af5022f99cc2692fcf9e35bd959f9bdd137b5409d77bdb9b0ce2c7d10c11
- MD5 58fd26475a34b731dfee48aa91324836
- SHA1 982be474e1068d5df57adf8ba4030066aaa7dbcb
- SHA512 84f734315f6c5a79eeae2fc4d68092dd3d7b66850c7d73e003d9b95e0c175f411cd297be497f14cc1ebce0c363eb08f5781c5a545b0e4fb9b22a9b86221a3be0
- SSDEEP 24576:Emv3ujNvpDkRuuTI2a61FxnYUqtlOB/am6+bZ7RLhHB:Es4vDkRfI0amr9r
- TLSH T163754B03A3E5CEEAC85AB33451CB271AB734FC5117A3ABDB425052612E577D99E3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH