Overview

overview

7

Static

static

3

7z2603-x64.exe

windows10-2004-x64

7

7z2603-x64.exe

windows11-ltsc_2024-x64

7

Resubmissions

10/09/2026, 17:55

260910-whq4nawte1

10/09/2026, 16:43

260910-t8rf1aej9x7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 16:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7z2603-x64.exe
  • Size 1.6MB
  • Sample260910-t8rf1aej9x
  • SHA256 0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7z2603-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\7z2603-x64.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    PID:4916
  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:4700
  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\GetRestart.xlsx"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3980
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap28911:84:7zEvent7823 -t7z -sae -- "C:\Users\Admin\Desktop\ProtectSplit.7z"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3520
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap16186:80:7zEvent29579 -t7z -sae -- "C:\Users\Admin\Desktop\ProtectSplit_2.7z"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1448
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap6757:84:7zEvent15525 -ad -saa -- "C:\Users\Admin\Desktop\ProtectSplit"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4412
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap499:82:7zEvent7928 -ad -saa -- "C:\Users\Admin\Desktop\SetUnpublish"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7-zip.dll
        • Path C:\Program Files\7-Zip\7-zip.dll
        • Size 99KB
        • SHA256 25a48d1f1cad86e81dd6504362cf039a381e14aa7a38b06cb7ba3839b735f35e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 1.8MB
        • SHA256 65e4c1f855f9ef6e8f0f5df8e3f27d9eb5f07311408639da0a1ca0b8f4871b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 980KB
        • SHA256 7f7067b2264fbf8cbd1348cf7f41a0e35c928de750d53533c963ebe334dbd612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 708KB
        • SHA256 a7c4ea7942fcb3d438344f9ee0be6e56bc9becab4c715ce187202f94b42f946c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProtectSplit.7z
        • Path C:\Users\Admin\Desktop\ProtectSplit.7z
        • Size 17KB
        • SHA256 b5da3be18e157b41ae081456418bcc8b66dbc2ea292886913fd812bfb1013224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download