Overview
overview
10Static
static
13z9AHWx-67...84.eml
windows10-2004-x64
13z9AHWx-67...84.eml
windows11-ltsc_2024-x64
8PRO840423S...92.rar
windows10-2004-x64
1PRO840423S...92.rar
windows11-ltsc_2024-x64
8PRO840423S...192.js
windows10-2004-x64
10PRO840423S...192.js
windows11-ltsc_2024-x64
10email-html-1.html
windows10-2004-x64
3email-html-1.html
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
3z9AHWx-67450-08b2F9D1829497BCF4A686b9684.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
3z9AHWx-67450-08b2F9D1829497BCF4A686b9684.eml
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral3
Sample
PRO840423SG8_XEZC_1892192.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
PRO840423SG8_XEZC_1892192.rar
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral5
Sample
PRO840423SG8_XEZC_1892192.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
PRO840423SG8_XEZC_1892192.js
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral7
Sample
email-html-1.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
email-html-1.html
Resource
win11ltsc2024-20260709-en
General
- Target PRO840423SG8_XEZC_1892192.rar
- Size 2KB
- Sample260709-vr3clset8m
- SHA256 2f89acf0a56b00a1e1e20f754699df12ee350c70029988892ba4a93e3996bab0
- MD5 f2a77cf955e47115324a6ed15de37ec7
- SHA1 e7bbaccff4e71f46ac14b30bf7b532b823dcb3e2
- SHA512 83f59dfc1a99416e53add406e368cc9e3375402d8734b1d8dbb4f802d456357105cc5651359b0020ffe75a0a158927fce251fe83abe2d05357dcdd7ffe595ded
- TLSH T111512C7F8C9A1A7AEB5A2831A6AD7C276B920C59FC4264757691335250CE181B307D33
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2372 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2372 7zFM.exe Token: 35 2372 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 7zFM.exe