Analysis
- max time kernel
900s - max time network
500s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 22:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader (1).rar
Resource
win10ltsc2021-20260513-en
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
loader (1).rar
Resource
win11-20260513-en
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
loader (1).rar
Resource
win11ltsc2024-20260709-en
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
loader.exe
Resource
win10ltsc2021-20260513-en
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
loader.exe
Resource
win11-20260513-en
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
0 signatures
900 seconds
General
- Target loader (1).rar
- Size 12.0MB
- Sample260730-2kc8gagg28
- SHA256 c590a485c01bbf9bf39c5fc67a48989b30805317035b47f8a9c4727a428702ab
- MD5 7bb6abd97b8a21d28d0bdc0dd5cb3dfd
- SHA1 194266ce3c10c2e18dd6444ec9910f50e907de7f
- SHA512 64e407aacb3fabdf926f1a0d1f43b9ef888ba27b34121dc300370f7531193964c3434e024f8c9b2112957485ceb05942768e004728181a7be11125849490c2e6
- SSDEEP 196608:KvjxEylTiuk+TmyLlexF8CnxwzYItvW97+AyIsPlY2OyLF1IbVy+Yon4+U1jKkCl:AlEMiukGL8xlnGzN54i/9Y0F1IR+vx1+
- TLSH T120C6330A1DEB305B6AAD7E127BA3098E2E927054FF767147122D21D71244AFDCC1CA7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1400 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1400 7zFM.exe Token: 35 1400 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1400 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\loader (1).rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4488
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5468