Overview
overview
10Static
static
3setup.rar
windows11-ltsc_2024-x64
1bin/config_6696.bin
windows11-ltsc_2024-x64
3demo/packs...86.rpf
windows11-ltsc_2024-x64
3demo/packs...25.pak
windows11-ltsc_2024-x64
8demo/templ...66.dat
windows11-ltsc_2024-x64
3plugins/mo...98.dll
windows11-ltsc_2024-x64
8setup.exe
windows11-ltsc_2024-x64
10Analysis
- max time kernel
599s - max time network
551s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
setup.rar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral2
Sample
bin/config_6696.bin
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
demo/packs/content_8186.rpf
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral4
Sample
demo/packs/content_8625.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
demo/templates/info_7366.dat
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral6
Sample
plugins/module_2598.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
General
- Target setup.rar
- Size 19.3MB
- Sample260816-papsasdb44
- SHA256 4c766e41228e753ca2aac56fe5db8a2e2133692ebd13e6260a26b92bbbec7fd3
- MD5 4f0fcb3d97cc7097f437e69944963b8f
- SHA1 f5af74e31aebf172b0b1f01abd0c3bb33a47e45d
- SHA512 9b42a77cf5d574da5b0325593da923b6ee8d878fa0acec209bc406269abc48b91b3e036edf494614b324d81a5d1557e77cf492b27d788b6a59d24f039b847c09
- SSDEEP 393216:fT8DlcgJT/fZEY+GdOeafVp3gLxTuBN3ORNY4Z0VSzDa4Z1aT9dzOJmWs:fT8bJT/fZDaNpQ3nZgCnZovzOJs
- TLSH T17A173369DE3CBC023F551B7A3D0A8E850C22DA33541AF1A995374D6EDE61938DCE1F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5980 7zFM.exe Token: 35 5980 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5980 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\setup.rar"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:200
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:2360