Resubmissions
26/06/2026, 19:53
260626-ymazcae16l826/06/2026, 19:39
260626-yc6y2aev4s126/06/2026, 19:33
260626-x9nchset8x726/06/2026, 19:30
260626-x7vc2set7t1Analysis
- user interaction
yes - max time kernel
72s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/06/2026, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
sobfox.com.rar
Resource
win11-20260513-en
2 signatures
300 seconds
General
- Target sobfox.com.rar
- Size 99.4MB
- Sample260626-x7vc2set7t
- SHA256 2c862d33eb13c97b6babf5a1e812c8509b52dfc55cc60daaeeac4b535833a232
- MD5 f25d07d944b6de44d631dc3ec784a795
- SHA1 99c0688689fec903168266d1bf0a51776852f55e
- SHA512 420f3acc82ef448c80a81ba4bb8cc463c91e6ef46255695e450a2c2636334ea77bccc7cc47dfe0882eb441d27c224310c5aea20eeb402a621ff9fa9aeb0d4e9c
- SSDEEP 3145728:Io3HPMhB+sXKOjiZPW+cCOpq7vhEp/kuk:IeMhZXKk6+vq7vhCk
- TLSH T1E53833D8508EB5F09A1198086313BBD4FF5DF31B7071A16943F7851CA9CA4ABC49F8AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2472 7zFM.exe Token: 35 2472 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2472 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sobfox.com.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2472
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2172