Analysis
- user interaction
yes - max time kernel
138s - max time network
175s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
Moho.Pro.14.3.20241125.rar
Resource
win10v2004-20260513-en
5 signatures
600 seconds
Behavioral task
behavioral2
Sample
Moho.Pro.14.3.20241125.rar
Resource
win11ltsc2024-20260629-en
4 signatures
600 seconds
General
- Target Moho.Pro.14.3.20241125.rar
- Size 511.2MB
- Sample260705-cb2r2agv5v
- SHA256 90476fe641e9b58494fd1ba2dc311866d06ea494aff67c7ce81b8edf7960e118
- MD5 ee6f21b4cf414c2fbd1c1b174323dd13
- SHA1 fd683e87744b5e33ea144d2cb1d3d0008757a906
- SHA512 29ebaf5d545c065231fc51d4b571de70f704bf15f8adeb9f2904dc3efc6428e3a274142a5bf2de15db866d9561536f9511d65102593a146fac50710d545abd45
- SSDEEP 12582912:Suvtd+qx7t6b7DbxkwgGLZZr1SnwpwsqniHB:SS+qx7t6b7DNkmZr1Vqih
- TLSH T14F4933918FFA6DB788121A9C3FA5D095E10D95148B126AAFE0FF61D0730B372B62C1F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4556 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4556 7zFM.exe Token: 35 4556 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4556 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Moho.Pro.14.3.20241125.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5404