Analysis
- max time kernel
300s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 08:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XerinObf.rar
Resource
win10v2004-20260513-en
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
XerinObf.rar
Resource
win11ltsc2024-20260709-en
4 signatures
300 seconds
General
- Target XerinObf.rar
- Size 2.2MB
- Sample260820-kwfpaswvhs
- SHA256 2e7fabde41b3d7fe1cf5ee447b3eb2d76a3d02d4701e14263d5a33087251201c
- MD5 0ac949b82b277b50c00e8d82588771e1
- SHA1 65bb3047c9dbb9dd3a9347e330c9d30e0a9ed9db
- SHA512 c84281a87b546c3c9f73fc67256d31ba84a1a880ef3576031c85cf617631bb950b979977db5f96b36ff322c30f692fba4d2cf93287ed0373257320c00398e272
- SSDEEP 49152:wMi57MFf+Jr8Kq7tDKU/UrTy5bONLYy0VXPd9J:t+JrnqhDj/1bxXFP
- TLSH T178A533D9F485FA81DD7E22EA4F2311C859828F324B6E273439C50467287DC7ACDDB986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1232 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1232 7zFM.exe Token: 35 1232 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1232 7zFM.exe