d1aab3afd7714b4aefb8515cabaf2aeb0101a521f7dceda2f3cd41b744d6bcaa

Analysis

user interaction
yes
max time kernel
46s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:09

Target
$PLUGINSDIR/app-64.7z
Size 85.6MB
Sample260804-24849asfmf
SHA256 d1aab3afd7714b4aefb8515cabaf2aeb0101a521f7dceda2f3cd41b744d6bcaa
MD5 d297e9e2df321b6373398754d6a50c71
SHA1 8109d7af03cc654e4439b0a0812eefb3ebf748b9
SHA512 0ce5efdb641be7b1285bb1214cb5fa6064c9c38a40c1fa60a3969a436b62015dd0e10d05d1025f54e2e5c43f1f75d197400d5382adf94094bd27519e615c7968
SSDEEP 1572864:e+BWMFDe45knTQTSg6hDRVOg7PMqjJTlLMOJD2Z13nYcxWqQ0OQhU7hD:vBFle45iLhDRVl7RjLwSab3YFQSZ
TLSH
T1DF1833977AD9FAFFC44EB33E63F9356424D690839F53633D1082849A625CE517322A83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
256	Vilonity.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2448	7zFM.exe
2448	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2448	7zFM.exe
2448	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 256	2448	7zFM.exe	89

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\7zO0993C6E9\Vilonity.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0993C6E9\Vilonity.exe"
  2⤵
  - Executes dropped EXE
  PID:256