bde4942de8c0025a340f8ba9b79972811561f22461cd3fa112599c54d0a9ffa5

Analysis

user interaction
yes
max time kernel
82s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:48

Target
$PLUGINSDIR/app-64.7z
Size 81.9MB
Sample260804-3tphjatbqa
SHA256 bde4942de8c0025a340f8ba9b79972811561f22461cd3fa112599c54d0a9ffa5
MD5 452c547ec0798e7fab7f04d875139cb9
SHA1 a34ae2e91da833b42fc958d75b65ece8c7d0d7de
SHA512 4401c51d5f9b6f5e803ca0724146cfd21960e5960e9f2bf96a9f519fea8a716020244db414303d74645fb39aadb5b7d13e7e8eca4e7458629d35406bd05069f2
SSDEEP 1572864:TlH6/c1Uvj3Of7LqFdzLcBdyNyBnrO+U1deWz10:TN6/iPqFdncBdyN0OTPzS
TLSH
T1FA1833A94471292FC1BDD839D997DDA586C338EC2F519A87A76B39373A770046E3230C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
244	ORS.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3388	7zFM.exe
3388	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3388	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3388	7zFM.exe
3388	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 244	3388	7zFM.exe	90

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\7zOC3D4EE1A\ORS.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC3D4EE1A\ORS.exe"
  2⤵
  - Executes dropped EXE
  PID:244