3a4fc26f9f625361f09fb0a6a5f97c9fec60c5ab0f8425b2739e8a9082123c3f

Resubmissions

04/07/2026, 02:25

260704-cwkdgsat9w1

04/07/2026, 02:22

260704-ctm2laat8v1

Analysis

user interaction
yes
max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Occ'x Discord Users.rar
Size 22KB
Sample260704-ctm2laat8v
SHA256 3a4fc26f9f625361f09fb0a6a5f97c9fec60c5ab0f8425b2739e8a9082123c3f
MD5 60286a04cc28672ab82eff913e95405d
SHA1 35e68a9d346e8498280c21bd986a65a8dec1b5ca
SHA512 aced48343c0059a98765a06e6308c1de5e25b7c216006def41362f1424b61edf046c8de43969ef53f26a94929319629946159f134c84655a13e2e831fc0a0a2c
SSDEEP 384:n8Wt8mDB/xkNOTFeZPZFUpBGl4376Dw89F6r7YU0JTOqQ0M6dIAsPVRkLCCq2:EmNxkNOTEPDUpBG/DF+r7uG6IXVRkvq2
TLSH
T1FFA2D0222F901C63763170E457B25BD12236A793E28DC2D6F36885CAFE4B46BED61D31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Malware Config

Signatures

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
2464	notepad.exe
4468	notepad.exe
5944	notepad.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1204	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1204	7zFM.exe
Token: 35	1204	7zFM.exe
Token: SeSecurityPrivilege	1204	7zFM.exe
Token: SeSecurityPrivilege	1204	7zFM.exe
Token: SeSecurityPrivilege	1204	7zFM.exe
Token: SeSecurityPrivilege	1204	7zFM.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
1204	7zFM.exe
2608	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2464	1204	7zFM.exe	88
PID 1204 wrote to memory of 4468	1204	7zFM.exe	90
PID 1204 wrote to memory of 5944	1204	7zFM.exe	91
PID 2608 wrote to memory of 5060	2608	OpenWith.exe	93

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Occ'x Discord Users.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\7zO4B487139\config.ini"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2464
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\7zO4B47FFE9\proxies.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4468
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\7zO4B40F1F9\Run.bat"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO4B4BD6CA\Occ'[email protected]
  2⤵
  PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Run.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO4B40F1F9\Run.bat
Size 816B
SHA256 34fc4b28351d44f84ed04a4e4234fb2435963e15e47953f98dbbfbac2a13f107
MD5 69a2138de26323cd9e922e5b0c1b5287
SHA1 28c7482e9a5f3dd8fa8ab432ceef39328b1bb53f
SHA512 bfe20ce9ad1e1b658690e16a48564e111d55d7ed03c6538df8fa8815feaa0a0666504cf36c4fad920f5f2da64f5fceb9b16df90ee2334ffe4857c507ffbce2c3
TLSH
T1DC01DD2B372690A097584C0EC83644E8FC72AF93D60ABD2420E710701D86B97F75A73B
MD5 SHA1 SHA512 TLSH

Submit Download

proxies.txt

Path C:\Users\Admin\AppData\Local\Temp\7zO4B47FFE9\proxies.txt
Size 236B
SHA256 ca66de50a731f7c64cdafe278a7c967b2e73b2d0ee8290090df4455c0f72ae9f
MD5 25d0d2cb3057c2f5d80c066de6e21c70
SHA1 7cfc162230979788f155baa25d1767d0ef626e8e
SHA512 8976716a9d20a47ba95cef2e7a525d8361a1fdbd04dcce9ecac3dbe7dbbcdca53057a6f474ff5aed60876939e56a2be0499ac1af87d5db178da960d7e59ce92b
TLSH
T14AD0025D60AA9552CC746918B02801562EE1059A9B94254110D5437A9C744A4502D9A5
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7zO4B487139\config.ini
Size 434B
SHA256 f4bcec3d0ed0753deb60ab6d4d5ced2d51f286e21c2f6a5eb0bb1f984cc10f0a
MD5 a4c525c2382bcded4a4b9f6a1e19cb8b
SHA1 9164fbe425f37c8191d61f5dab6d723d0aea7fbb
SHA512 dd483c5655616c641d69bfd9e8bc92e9a90aba1ba4bd0ae8adbd5e7d5e24cee7738667520d6f5da31925f30dafd3fec83f97dc49a48ab7fe42e82402b5eb0656
TLSH
T1E3E0E5F5668A3420C6765E0984D22469D4313CA77907BC11F5923E41E8ABD1363DAA78
MD5 SHA1 SHA512 TLSH

Submit Download

Occ'[email protected]

Path C:\Users\Admin\AppData\Local\Temp\7zO4B4BD6CA\Occ'[email protected]
Size 9KB
SHA256 88158eadcbcf6b46ce1832e946d33f108dc5303bd8f548841d4992b4be97aac7
MD5 4e84d9792f8a232be37c15d253975832
SHA1 168274dacb2de5f0d0a233dc0be659a2a2d63130
SHA512 ef8f1034ef918e3b46b81e5ab81679cb73a57c49ea83db84ac38b1062c2cf8d7c00f10fe8fbf383d44f45982ec0a20f0ab75273c532acabfec37cb019d9c8ed8
SSDEEP 192:MvYEAcnBQFbQLvGNnr/+a6J12PAwKUu6qDHcHfTbNMljK/lUpJawBVQE+:0zBQwaiHoqzc7bNMljKdUucJ+
TLSH
T1641284328C120C3386789E1CC9B58D41F264D61BD169196774FC82CC9F7FAA3DEA16AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download