Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
Arhiv_elektronnoho_dokumenta_22.07.2026.126634.rar
Resource
win10v2004-20260513-en
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Arhiv_elektronnoho_dokumenta_22.07.2026.126634.rar
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Safe_privet_documet_22.07.2026.126634.rar
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Safe_privet_documet_22.07.2026.126634.rar
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
pass_22.07.2026.126634.txt
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
pass_22.07.2026.126634.txt
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target Arhiv_elektronnoho_dokumenta_22.07.2026.126634.rar
- Size 25.0MB
- Sample260722-rtfpvawgne
- SHA256 ba243e591b5643b65f92898bd44b3cd88a7a662c959560f097bfd367efbb4834
- MD5 5aca28ef7d9a18a61290bcc55e59d987
- SHA1 240855f27281982edd46874ad7d0016a81cbfbf8
- SHA512 09e5ae9642725e9cd6476a1a63fccab94355873ce1ee007257dad993e660847d5bdec94c5cfb854efc38e4cf00aa5a421c3f06b60f2b6d123930a2133aa1e46f
- SSDEEP 393216:x8MzO/gxYrvMbD+bcsJ+mYXBLEHUl82I2lzx8OcjbSBRvd6Yk1XQXwBDAEolekls:SBrvQDycS+mYRI0O2I2llc8FU0TkxtV
- TLSH T1D5473363FD9340DFAD8D3D8AA45B923BD0312C5C39C416E6A53988158DEEF9CE0D19E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4460 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4460 7zFM.exe Token: 35 4460 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4460 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Arhiv_elektronnoho_dokumenta_22.07.2026.126634.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4460