Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
xqzmed.rar
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
xqzmed.rar
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target xqzmed.rar
- Size 502KB
- Sample260819-bvrwhacd82
- SHA256 111b4d42bae72775fa3a454d6a9bff506593b52c7b675c99c6f4392a3fb8e075
- MD5 c2765fcf506085a126c603315ba86069
- SHA1 d1a628364f236959ee1d87d4c69ec4726708ce8b
- SHA512 8283d791a1a95051edd667a8fb3186e89ce2a30435efbfe96b08078e03854a3ee9932d04b5d307e11054f1bd27b7b8be23db5d1e7feae4a104b25be7ff4bc0fd
- SSDEEP 12288:sjc8Qn/2XA3bRKmXDSMtIo64iP7kjR37CypN3H2uDOjRRf8:t8Qn/eebcmXDPY4iP7e3f72LR0
- TLSH T14EB423D76F2FC7CEA15A0CB8012852FA1D2D964B4219F3361E963651B09E0C686F9FCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4132 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4132 7zFM.exe Token: 35 4132 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4132 7zFM.exe