3e86eb9f87c658f8496d7c11c5b3897d67d73ff32fdb745dd525947f62adf5bf

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New folder.rar
Size 8.0MB
Sample260910-1gplnahj71
SHA256 3e86eb9f87c658f8496d7c11c5b3897d67d73ff32fdb745dd525947f62adf5bf
MD5 4b357e38673d51f7a4302cecdca22fa8
SHA1 41fd0119473cd7dadb37ace33f50cd1caf6e31b7
SHA512 1b6b739a84e406f7c0b9bcf5a11256c18fe7e5b5ff8830fa8dd7924687db0053a1684179df4507fa87e7bb358a787683641592d12e29f94a80a5384a6302fa59
SSDEEP 196608:GBKtkQq1dnr0OeMy2w7d8z0a/she58wg5m7:EKqdnK/uYaUh1wgo
TLSH
T1748633C430DAC066CFB45FA6A5F149CAF1F911D832430B5DEEE8098A869E01E6F0576F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4248	mspaint.exe
4248	mspaint.exe
2380	mspaint.exe
2380	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3940	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3940	7zFM.exe
Token: 35	3940	7zFM.exe
Token: SeSecurityPrivilege	3940	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3940	7zFM.exe
3940	7zFM.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4092	OpenWith.exe
4248	mspaint.exe
4248	mspaint.exe
4248	mspaint.exe
4248	mspaint.exe
3692	OpenWith.exe
2380	mspaint.exe
2380	mspaint.exe
2380	mspaint.exe
2380	mspaint.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New folder.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ملبورو\Default\StereoSound.plugin.js"
1⤵
PID:1808

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ملبورو\Default\Share_Tab.bmp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3692

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ملبورو\Icons\App_EAX_Setting48.bmp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 2f7b1cd28a8c954f348920e0fd5c6094e218c9ee2d7c383296700ad84fc890eb
MD5 d924f5190140a7923725893d885cf3e6
SHA1 5b5591f791a57b7a532aa21209619016ccd139c3
SHA512 c3add4e78e5fdb1efb66540f19762df37a83505d0b7060385773f3fb5eb49732e00677ae81d551bff944e4aeec87d2ba7a8c1918e85c5a125c25a8e3841b8e40
TLSH
T12E61FFADC6A02C8FD7BB310DC75510951F6FA8E669E240710E3FAE96906E14CC3FB846
MD5 SHA1 SHA512 TLSH

Submit Download