5b0b5aebb1c9827e83c2b3efd8e9efef3828093750cac52d467da0a8be8c610b

Analysis

user interaction
yes
max time kernel
84s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/08/2026, 11:05

Target
18356217AC83924E.zip
Size 26.5MB
Sample260816-m6vbjswejc
SHA256 5b0b5aebb1c9827e83c2b3efd8e9efef3828093750cac52d467da0a8be8c610b
MD5 925cd2397335907bebef8928a3bc471a
SHA1 e033ff3f168dd6aa0ac826e0e5c49203131236f3
SHA512 9107c368d6e1a8e02283dbadd17551fdeb308cb302fe21789b0ba29909b405dc2ec113aba8bc10d4f479c795b21f04be6518744ffdd307ab8d420064c1fa9aa8
SSDEEP 786432:60bakOvySDs3kWzPmnQpsQVzq+OEjJDJmfYJ9ymqWD:S44QGQVzJdYf9nWD
TLSH
T18E5733788063B028ECDC09B4B2C78EA6F650C16666E7CD6B8797F97B636D87034F6441
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
384	75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc.exe
384	75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4028	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4028	7zFM.exe
4028	7zFM.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\18356217AC83924E.zip
1⤵
PID:2180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4408

C:\Users\Admin\Downloads\75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc.exe
"C:\Users\Admin\Downloads\75cc72a837e7f277be2f45df167230d087c94784b1500b0847ce848553f407cc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:384