07a7c1715a2f4c41f284100c4a4298542b429f325212a356ffab41c14cc23cc2

Resubmissions

04/08/2026, 21:57

260804-1t9glahe327

04/08/2026, 21:54

260804-1sm7zaep8x7

04/08/2026, 21:49

260804-1pm3ssyxfz7

Analysis

user interaction
yes
max time kernel
42s
max time network
49s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MagicKeyBattery_v1.2.0.rar
Size 61.0MB
Sample260804-1t9glahe32
SHA256 07a7c1715a2f4c41f284100c4a4298542b429f325212a356ffab41c14cc23cc2
MD5 9109ec1221d6d9a9d90de0502a4dd12e
SHA1 2b7d75264b5606ecc9dc5574b6794c7b1c0e6800
SHA512 50d03c93ede6ccba1b4a38c2048231bc07fb52ee0673b87b7e42bc0d9c45f13e4ae3bf1dde20870354e800d84fade1e9bcae28582e536590856412da9ec9d10e
SSDEEP 1572864:IlhYxAeh0VVoAx7s6Fi5rzjKpd/Mblq0+w1LSNrNK5:DA86Vl0jK7/MbWQSFNK5
TLSH
T142E7335793627B5282C26BF2192FD25797BC0739A903F4F4B8491761CEE1890BECDB06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4420	MagicKeyBattery.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4356	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4356	7zFM.exe
Token: 35	4356	7zFM.exe
Token: SeSecurityPrivilege	4356	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4356	7zFM.exe
4356	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MagicKeyBattery_v1.2.0.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3304

C:\Users\Admin\Downloads\MagicKeyBattery_v1.2.0\MagicKeyBattery_v1.2.0\MagicKeyBattery.exe
"C:\Users\Admin\Downloads\MagicKeyBattery_v1.2.0\MagicKeyBattery_v1.2.0\MagicKeyBattery.exe"
1⤵
- Executes dropped EXE
PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

MagicKeyBattery.exe

Path C:\Users\Admin\Downloads\MagicKeyBattery_v1.2.0\MagicKeyBattery_v1.2.0\MagicKeyBattery.exe
Size 158KB
SHA256 64ef9bf3f0ed896e30f4aa6e5b3c22fb5c9d6e515493293bc2a27dd03eb1b9b5
MD5 f5424269518a6eef9a600436be570c17
SHA1 ca332f29766501a0599131cb96ea1fb385ce0489
SHA512 c029d4bf18e95b09b389eccba78d4adcc58fc601f2233059de347c82e2305bf899fd44f3b05ec4eb60de328d4de9785d8a35a323a1c9d1627bc325969147810c
SSDEEP 3072:elDJk88wN1QI7sxrYL1peQ3lOY9SkHNwGmyzaAT5A3:SAIwxrI14Q3kYB+tL
TLSH
T1E1F33C13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EBA0F77BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MagicKeyBattery.runtimeconfig.json

Path C:\Users\Admin\Downloads\MagicKeyBattery_v1.2.0\MagicKeyBattery_v1.2.0\MagicKeyBattery.runtimeconfig.json
Size 519B
SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
MD5 7e4444b5a3e3cea574693f055f944011
SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
TLSH
T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
MD5 SHA1 SHA512 TLSH