Overview
overview
7Static
static
37z26.02-zs...dm.exe
windows10-2004-x64
77z26.02-zs...dm.exe
windows11-ltsc_2024-x64
77z26.02-zstd-x64.exe
windows10-2004-x64
77z26.02-zstd-x64.exe
windows11-ltsc_2024-x64
77z26.02-zs...dm.exe
windows10-2004-x64
67z26.02-zs...dm.exe
windows11-ltsc_2024-x64
67z26.02-zstd-x86.exe
windows10-2004-x64
67z26.02-zstd-x86.exe
windows11-ltsc_2024-x64
6brotli.dll
windows10-2004-x64
1brotli.dll
windows11-ltsc_2024-x64
1flzma2.dll
windows10-2004-x64
1flzma2.dll
windows11-ltsc_2024-x64
1lizard.dll
windows10-2004-x64
1lizard.dll
windows11-ltsc_2024-x64
1lz4.dll
windows10-2004-x64
1lz4.dll
windows11-ltsc_2024-x64
1lz5.dll
windows10-2004-x64
1lz5.dll
windows11-ltsc_2024-x64
1zstd.dll
windows10-2004-x64
1zstd.dll
windows11-ltsc_2024-x64
1brotli.dll
windows10-2004-x64
1brotli.dll
windows11-ltsc_2024-x64
1flzma2.dll
windows10-2004-x64
1flzma2.dll
windows11-ltsc_2024-x64
1lizard.dll
windows10-2004-x64
1lizard.dll
windows11-ltsc_2024-x64
1lz4.dll
windows10-2004-x64
1lz4.dll
windows11-ltsc_2024-x64
1lz5.dll
windows10-2004-x64
1lz5.dll
windows11-ltsc_2024-x64
1zstd.dll
windows10-2004-x64
1zstd.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
7z26.02-zstd-x64-ndm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
7z26.02-zstd-x64-ndm.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
7z26.02-zstd-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
7z26.02-zstd-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
7z26.02-zstd-x86-ndm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
7z26.02-zstd-x86-ndm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
7z26.02-zstd-x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
7z26.02-zstd-x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
brotli.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
brotli.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
flzma2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
flzma2.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
lizard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
lizard.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
lz4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
lz4.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
lz5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
lz5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
zstd.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
zstd.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
brotli.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
brotli.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
flzma2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
flzma2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
lizard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
lizard.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
lz4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
lz4.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
lz5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
lz5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
zstd.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
zstd.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target 7z26.02-zstd-x64-ndm.exe
- Size 3.1MB
- Sample260722-l7lkcsde36
- SHA256 305a994fc3dc9fc0b252767a9719fcd9899ef652e46aa100514731af0b558a33
- MD5 232c7dd30545d20af09305427bfc671b
- SHA1 9aad64e19224f646bd2a14faf4860d56f09b838b
- SHA512 95868edb960c5501265be02ea18f9467afe1b414b54177eb8529b6e49f493b9e95a5ccdd5f16916d0eecb325c6bb2d4cbad59b0398a90afa812b20e80e1e9b85
- SSDEEP 98304:yYpDtSfgaf6TLYkyOkmjNyN63SPtAO9HpkRRXZIScK:j9tSNGBjSH2RpZIQ
- TLSH T1B8E5331275F2E0FDD4BAA63858554102FFB27C2243608BFF1A60C69A2E636D05D7EB35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\va.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\yo.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7z.exe 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\eu.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ku-ckb.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\pt-br.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\7-zip.dll 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\7zG.exe 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\zh-tw.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\7zFM.exe 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\el.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ps.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\pt.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sv.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\License.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\descript.ion 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\fi.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\he.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\hi.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\hu.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\nl.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\sv.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ar.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\kaa.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\uz.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\zh-tw.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\License.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\7-zip32.dll 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7z.sfx 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\fur.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\mng2.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\nl.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\si.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\zh-cn.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\be.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\fi.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\gl.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\mk.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ro.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7za.dll 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\az.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ja.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\pa-in.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ps.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sq.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\readme.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\hr.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7-zip.dll 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\7z.exe 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\7z.sfx 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\az.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\cy.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\fa.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ky.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\bg.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ca.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\eo.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\eu.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\fr.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\mng2.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ru.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sk.txt 7z26.02-zstd-x64-ndm.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\af.txt 7z26.02-zstd-x64-ndm.exe File created C:\Program Files\7-Zip-Zstandard\Lang\an.txt 7z26.02-zstd-x64-ndm.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000} 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip-Zstandard 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000} 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip-Zstandard 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip-Zstandard 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip-Zstandard 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip-Zstandard\\7-zip32.dll" 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip-Zstandard\\7-zip.dll" 7z26.02-zstd-x64-ndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z26.02-zstd-x64-ndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip-Zstandard 7z26.02-zstd-x64-ndm.exe