Analysis
- user interaction
yes - max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
Soundpad_.rar
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Soundpad_.rar
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target Soundpad_.rar
- Size 7.4MB
- Sample260808-grslhsan2s
- SHA256 0bc4ce9d34b8ee1a67fc3a24c7b4b90ddcb59912ba59ee6f24ae9532dc0e8ba9
- MD5 08fee2ec50dde18417f1b91a904f107a
- SHA1 d4c4e7d2382d0c1b4d5166745a163eae01f5c453
- SHA512 fae7457d7a449690cc7f5cb155ddca02c88dfad7b7f4471c3835c7d76495ab34fa534f8c3dfd6530f6e865aac7226eb036e8690a5d0c19cb1b3c21334e5b8e72
- SSDEEP 196608:pgR95NJznFht1VpDjUTJ4g9FzsqcxvbCtxQZxJyufHd8M6o3Cy/mo:pgR9vJrFhXjDjUTLFzTcxjCtmZyufHqy
- TLSH T12E7633FE4EFFD9E5C67209775CA93C8D656993C06E5F4F0C930819A0382270B686E9E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4936 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4936 7zFM.exe Token: 35 4936 7zFM.exe Token: SeSecurityPrivilege 4936 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4936 7zFM.exe 4936 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Soundpad_.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4936
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5516