eac5c75a8f382613a593a62f32603b09c77ca3659d20ca366c1e9bc97dc89bf1

Analysis

user interaction
yes
max time kernel
26s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VapeCrack.rar
Size 13.1MB
Sample260719-dcs2ysc13z
SHA256 eac5c75a8f382613a593a62f32603b09c77ca3659d20ca366c1e9bc97dc89bf1
MD5 d5dee9e9c4beb07a7125b4dc51e084fa
SHA1 cfaa9612450007b60d6683bfc094d9ddf37d6083
SHA512 8cb1c53e24760ff3493dacd213efb58f3124188081b21e340aad80d155a168552a7aac25cf0811a4a90de3bc6134fcf552727da57b2c2cae615853fe6165fd01
SSDEEP 393216:3eCHkC9IxvqCu381BHec73bOkyxkQOKodcOZghz1Ao/oS:3hH19m2M1BNkxkQT+cOZghzqo/oS
TLSH
T13FD6331140ACF295D5AA8F5E0ACC96CB1DD9987DD21794670EF02C9BFD8B28D1AF304B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3316	Injector.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1152	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	7zFM.exe
4676	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4676	7zFM.exe
Token: 35	4676	7zFM.exe
Token: SeSecurityPrivilege	4676	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4676	7zFM.exe
4676	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3316	4676	7zFM.exe	87
PID 3316 wrote to memory of 1152	3316	Injector.exe	90

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VapeCrack.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\7zO44288D38\Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44288D38\Injector.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - Executes a command shell one-liner
    PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Injector.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO44288D38\Injector.exe
Size 14KB
SHA256 3361545f3f475f0467d249db6511046b5f9717e7aa80d736c16065e267045150
MD5 2629d4edafe5cbd84dc3ec22865d52d5
SHA1 c826d177cf65fee52b4d0adc4a2a330106db54ad
SHA512 33c633237c71227a59c95f31e34becb615e67ef2950c5d2b3ba09892c952d915a4cf4a95471681e2361a24b6615d43ec6ea29e1237950b755cacca6ea4e2e879
SSDEEP 192:iCdHvYL73pkN6eaJdsd7515Bfh9OdS/C3Q5tfTcd:Jtw3ppLwZL63d
TLSH
T1C5623A0677961CEAC416D1728C731925D4F6B23603224BCF77E4C82A2F796D1BC3A28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download