989ccbe22e3bc07b71f363018fd84ef6bfa66e2047551a1b78fe87b87f95b1d0

Analysis

user interaction
yes
max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ghost.7z
Size 102.2MB
Sample260809-szp15sbb32
SHA256 989ccbe22e3bc07b71f363018fd84ef6bfa66e2047551a1b78fe87b87f95b1d0
MD5 fb20cfe80c51709cdf24feaf7c696bf4
SHA1 82645d57655119aa513868b9102c053eb9cd280c
SHA512 0535b23342740cfc2af353c283a9d0b224d2b290644be3584a611773932e521fdb67b8b2dd31a6dcf98c0d0e370c899eb110a9e9a5ade4e41970912880c575dc
SSDEEP 3145728:WtLQhuZyKCXYhkWWprsV4OHTIOLH/xZyBsVu:WaeydIhSr18HzSsY
TLSH
T1633833F322FF0B712BF1A7F7AA4B551277DB3D18AB419A4AC806E1DF9B710628457018
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2980	Ghost.exe
1108	AutoIt3.exe
5200	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 5200	1108	AutoIt3.exe	96

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4152	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4152	7zFM.exe
Token: 35	4152	7zFM.exe
Token: SeSecurityPrivilege	4152	7zFM.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4152	7zFM.exe
4152	7zFM.exe
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1108	AutoIt3.exe
1108	AutoIt3.exe
1108	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3288	2980	Ghost.exe	93
PID 2980 wrote to memory of 1108	2980	Ghost.exe	95
PID 1108 wrote to memory of 5200	1108	AutoIt3.exe	96
PID 1108 wrote to memory of 5200	1108	AutoIt3.exe	96
PID 1108 wrote to memory of 5200	1108	AutoIt3.exe	96

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ghost.7z"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5736

C:\Users\Admin\Desktop\Ghost\Ghost.exe
"C:\Users\Admin\Desktop\Ghost\Ghost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:3288
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:5200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exists.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Exists.a3x
Size 1.0MB
SHA256 1e9f2e28ede5c8f897cd827fbdec5770ae0365328d2473e9a003f3efaba5efc6
MD5 f7016faf30f56ea94afb21854905c071
SHA1 2efe0b45a49ae2fb1b561e18f2383e2b5a21002a
SHA512 cf11ebafa46379b7174417c581fb857cb6e3c4d9eb4d75a1810bcee9d854f6281c93479affc69ad3a628b12f81874fcc710b087a778ef6df18125c13e576a276
SSDEEP 24576:g+M8piSledONv4Ws0IxSdWy/1yOsNtjoWkxZIdmZif/3dVOvg9u:xpFe2gcoSsy/1yOsNtjoPICifyvg9u
TLSH
T167353317321165A88156FEE2F1BF042A314F0ECC10D9153A3ADBDE5E364E69B50AFAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghost.exe

Path C:\Users\Admin\Desktop\Ghost\Ghost.exe
Size 1.7MB
SHA256 dcb07928f2b91f05ee022505a2c0137e185bd260ec71b00e8dc7ee2f282a9108
MD5 35d3f771bdceeaf96cfd170ef50632b6
SHA1 3b1cdc9c544cfc0aa4e08863a59beb3cd496fe84
SHA512 28bb61a4da5dbde83a6322e5e669e528868ff1973649ffe4331394c597421e19637952da59b9b371c836ef279331b983e5163a1bee99bf04e09691dcba665377
SSDEEP 49152:568lEpdR+xCoSSyO16OkHg1lVIzdfCGg1G/hr7nWf:568lEpdFoSSyCkg1lVMdaGY67nW
TLSH
T1E385230323D044AAD079ABB594F7081B653ABDC0467547EF33A4D98E2E33BD6A43674B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-272-0x00007FFA74000000-0x00007FFA74263000-memory.dmp

Download

memory/1108-273-0x0000019E532B0000-0x0000019E532B1000-memory.dmp

Download

memory/5200-275-0x0000022527960000-0x00000225279B2000-memory.dmp

Download

memory/5200-276-0x0000022527960000-0x00000225279B2000-memory.dmp

Download