c9438d7cb1070da08cc5d8d953920b4c947990d28f0a5e4606602b3252e56c93

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Keyfilemaker-BTCR.rar
Size 7.1MB
Sample260827-bckdpswwdx
SHA256 c9438d7cb1070da08cc5d8d953920b4c947990d28f0a5e4606602b3252e56c93
MD5 36568ccbd369e37fc10ce84e9e150051
SHA1 850d50b32a6ffab1445e205dbe934f8892999e65
SHA512 410f69a7a13d5004b25cbcc139339dc12a6b3eccdeb8b4f7165d6fa85e07eb17761b9b1679c2d88011ca20cbd389508ebae9e0404292971528ba721a198f2387
SSDEEP 98304:0MINW8p/f9rrJ6Ov+sRQwT1hdpljQS76nvy1lMf4UjO1nn7bL41:tIow/f9USFevy1lMGnXL41
TLSH
T1F5769E03F29181E9C06DC074835BA637FB32BC8D4525B2AB6BE44B622F66F506F5D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1360	7zFM.exe
1360	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1360	7zFM.exe
1892	msinfo32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1360	7zFM.exe
Token: 35	1360	7zFM.exe
Token: SeSecurityPrivilege	1360	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1360	7zFM.exe
1360	7zFM.exe
1360	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1892	1360	7zFM.exe	95

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Keyfilemaker-BTCR.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\system32\msinfo32.exe
  "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\AppData\Local\Temp\7zO05587468\btcr.nfo"
  2⤵
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

btcr.nfo

Path C:\Users\Admin\AppData\Local\Temp\7zO05587468\btcr.nfo
Size 13KB
SHA256 606c91c4539caaa3bba39ba4fd42ff9a5b2c9d8396ab82dc720ae132233f87ae
MD5 0f5860e3a59c9ae5257f1cdab0556a62
SHA1 3da03b5fc8872cc1ffa122a38f6b01f6be256c7e
SHA512 f70bda185d553f7404ad4e7bc2af0a51d2cf2c7b913df526629284238bcffea7525c8db8d7e167136126a4963fa6951d5cad0587c463502e276ca783315e99fb
SSDEEP 96:mIjrEVzGeg/4hb4VGOkJ0fjW7JPg/ZZezKbBzrpB0L9kYaNa3VCuo:mtTWG1J0bii/ZZEuB3NNx
TLSH
T1115257129226FAFEBA31D6711E540255FE95AC5F073937E0306F8122BF37D9601EC629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download