Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
Spynote Q/Spynote Q redmask 2021.rar
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Spynote Q/Spynote Q redmask 2021.rar
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target Spynote Q/Spynote Q redmask 2021.rar
- Size 65.0MB
- Sample260822-ttzh3a1vbw
- SHA256 16b256e9434b4ed804756e34a07e9f475a539f9728949b5e0abcebc0138f5369
- MD5 7a51bac7be18b3692e8ab53ca59efdd2
- SHA1 52b6cb35ad880fe8f6e9e04bf0af9a6c437e10c2
- SHA512 c6712374fd87ca6bbaa22d01826ce29aabadab39b6a207c74b5451cc18442f1a50b76333e2ee066c8bab66329eda2ad20c440695ba5e31bf933e8a7a012bfc6d
- SSDEEP 1572864:gmuDfTqZaKVmoaNh7ft70J98my4zZVAMIHh/d+Bz/BN9tSN:gmVZzUb7F4J6tUaB/KG
- TLSH T133E733213D48BBD835E65B7B448B837E5B1B1C5FBCCB6A01CDA1B83B214ABD2446235D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5808 7zFM.exe Token: 35 5808 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5808 7zFM.exe