Analysis
- user interaction
yes - max time kernel
598s - max time network
428s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-uk - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
setup.rar
Resource
win10v2004-20260513-uk
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
setup.rar
Resource
win11ltsc2024-20260709-uk
4 signatures
600 seconds
General
- Target setup.rar
- Size 2.5MB
- Sample260731-ph2rtsfp8y
- SHA256 36fc64ae9ca3751fab589affc3f76638d15be2cd5f8c466ee5515efed35e2e7b
- MD5 c0a592e8efbac25298689cbd788106b2
- SHA1 61dc7ea3cce7df86d5ed7ba64161f95fd9fdee0b
- SHA512 7bcc259e77fdd7a1bedaf64af4b3242e2e741b21f769a4cc0921e5d175ef2c8cc1377d1ae6123235e3a64aa7aee69d04e5d1e73add83ee5642d94b3c1fffff6f
- SSDEEP 49152:o0TftFAGFdwrfXxRkQQ/Kwuy15ChgAM2l/3be4dpQkxdP+CyK3zds:o0TlFafXHQxUhd/Le4dlGCygzds
- TLSH T1E8C53336F06CAEEF3E07D285603015E172DCDBD81603F50FA965BD09EC9924B6CB9A64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1120 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1120 7zFM.exe Token: 35 1120 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1120 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\setup.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3764