f15e6eaa8b5d9696ff09016bd748f8c89b8272a5d54fe8ad015c4b31172e2360

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:03

Target
Expensive_3.1_by_Utwy_Fixed.rar
Size 55.4MB
Sample260804-ys7khadm2z
SHA256 f15e6eaa8b5d9696ff09016bd748f8c89b8272a5d54fe8ad015c4b31172e2360
MD5 f8f173d967ed08b172eceeb171c94114
SHA1 6b93e0ded7e65fed774b7026965a2c094f06016c
SHA512 e6881f600a81c5cfd247821d6acb59708e4adc238a111e8d6483abbed09566a3ffa66251a92ad8733ff4781e853931e7a1dfd1808d0f9c6bc93783c8b632662f
SSDEEP 1572864:P63QC8xOpswupz+5z5o2noez9Slfh8b4JS0mnjH8:cCOWwu4oCoez9qfh8nr8
TLSH
T1A9D7335BEF0F74CE2294D21E9C8662D648B8B666CF13006A1C6B0B076DE14EEBD7543D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4900	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4900	7zFM.exe
4900	7zFM.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2912

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\expensivefixed\expensivefixed.jar"
1⤵
PID:928

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\expensivefixed\expensivefixed.jar"
1⤵
PID:5996

memory/928-85-0x0000022344CC0000-0x0000022344F30000-memory.dmp

Download

memory/928-94-0x0000022343430000-0x0000022343431000-memory.dmp

Download

memory/928-95-0x0000022344CC0000-0x0000022344F30000-memory.dmp

Download

memory/5996-107-0x0000020E0C260000-0x0000020E0C261000-memory.dmp

Download