Analysis
- user interaction
yes - max time kernel
32s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/08/2026, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
SHADOW X INTERNAL.rar
Resource
win10v2004-20260513-en
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
SHADOW X INTERNAL.rar
Resource
win11-20260513-en
5 signatures
900 seconds
General
- Target SHADOW X INTERNAL.rar
- Size 22.4MB
- Sample260822-ja7p8aee54
- SHA256 2080b7e8abb393f757b59f4629442ef95b6a460877c0c77af5a8de2f962674e2
- MD5 28c21ba1c56439e0e5da5a1b5225d0ea
- SHA1 35089f99f2fc85577bddef30df09681527d27232
- SHA512 22da5a59eef521cb84b13826e74e2e9444d0ed74dd6a3a0a8293f7b2de0c9e68781943fb1c58fa09fc96913c1f34ecf4b248f66ab463f3661f18ef344930aa12
- SSDEEP 393216:UzLBFnYWNSDvnoauNvaVFjSfb+tVH+wh1w9Lv6IFpLNvoio91AjQBO9H7MRzgVtC:UTnYWN6noBNE48Hz1w9Lv6aanOQBO9wB
- TLSH T1D93733612D58BF3EF3E5181B3623D80F841CA255DBE2B53983B82B7E47E46216F8419D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3480 SHADOW X INTERNAL.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3480 SHADOW X INTERNAL.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2240 7zFM.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2240 7zFM.exe Token: 35 2240 7zFM.exe Token: SeSecurityPrivilege 2240 7zFM.exe Token: SeDebugPrivilege 3480 SHADOW X INTERNAL.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2240 7zFM.exe 2240 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SHADOW X INTERNAL.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2240
-
C:\Users\Admin\Desktop\SHADOW X INTERNAL.exe"C:\Users\Admin\Desktop\SHADOW X INTERNAL.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480