Analysis
- user interaction
yes - max time kernel
598s - max time network
438s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/06/2026, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
Leak_by_xmiox5.rar
Resource
win10v2004-20260513-en
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
Leak_by_xmiox5.rar
Resource
win11ltsc2024-20260618-en
4 signatures
600 seconds
General
- Target Leak_by_xmiox5.rar
- Size 161.9MB
- Sample260625-x4kpfaew91
- SHA256 9718b58c32e925ffcb6448350d14a3d54479a7a804d299db9ee38c82316d36a3
- MD5 da4f156bfb7753ad032d5f4e7b844dc3
- SHA1 db17cc8a0dac7076a56decf9ff3a244e87e73e45
- SHA512 d871b7bd2839ca816d2fd225a6b6eba0564ce1f4bd50d3a35ba995609795e7cfa14761cfd47b61f7c6e90266d04290384ca695ee7bb225e8acc82cfbc5c6434b
- SSDEEP 3145728:juIVlff6SL5ga6G+/Qv0yHwi8q45iKi9wI8f/hUTEZcIQnJwfN2UYtzmdCk2D0yS:j2kgRI0q8x5iKi9y/hUTEZcIaJwV2dQ3
- TLSH T14D88335774B492039A28B946579AC203F6F268DF2DEEFC5F1F81839E6BC5A0F1895103
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4088 7zFM.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 4088 7zFM.exe Token: 35 4088 7zFM.exe Token: SeSecurityPrivilege 4088 7zFM.exe Token: SeSecurityPrivilege 4088 7zFM.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4088 7zFM.exe 4088 7zFM.exe 4088 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Leak_by_xmiox5.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1484