7fce5e17ffe453c5ceda9ca8f034d0031da57a35fbacca23166fdf5c2c88b5fa

Analysis

user interaction
yes
max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:42

Target
$PLUGINSDIR/app-64.7z
Size 138.7MB
Sample260806-2mw4csvwhx
SHA256 7fce5e17ffe453c5ceda9ca8f034d0031da57a35fbacca23166fdf5c2c88b5fa
MD5 d23ccefb7bb9501781a6d8161c37ee3e
SHA1 daf740c65351e59f9db455f79059a09f7ae60cec
SHA512 6fdea9c54f5d024ba04553b1c73f1422022c687adba573f678fcaac8596c8bd20725752be736185444191148d839e1b1296b7c5ceb0b6d1797b1523630becea7
SSDEEP 3145728:7Pl4Rq9LScIs2BlUmGAtVN3oaM86SKwgF:qR1emGANv6zF
TLSH
T1A7683338304BCFADD71DB67493E21A5680318743EF1C8F9526126C9DEA91E8C6C5A93F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4580	KitsuMCLauncher.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5320	7zFM.exe
5320	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5320	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5320	7zFM.exe
5320	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 4580	5320	7zFM.exe	89

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\7zO8C46B2DB\KitsuMCLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8C46B2DB\KitsuMCLauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:4580