Analysis
- user interaction
yes - max time kernel
598s - max time network
492s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-de - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
Release-арp-x64.rar
Resource
win11-20260911-de
2 signatures
600 seconds
Behavioral task
behavioral2
Sample
Release-арp-x64.rar
Resource
win11ltsc2024-20260911-de
3 signatures
600 seconds
General
- Target Release-арp-x64.rar
- Size 231.5MB
- Sample260920-xsghms1bnd
- SHA256 22169ab3d9c3c19df0c3859250525ec0614bb8cabccb3392e14f9475a3788749
- MD5 2938d9c03f178541929a535651964118
- SHA1 bdaa0fd9bd3c748792b5faf34a4a875f434726c1
- SHA512 49b3f59c2a732ad7d5921fe2f5d3c2a675103a86f1c20efe3c3d033304cd7e7de577bde6c4b12bd380a77a3c09c3600428a6218262eb907fd305e097bc899e46
- SSDEEP 6291456:w9IXU1jY3WraKUIjRxY5di74qTI6Vfa3ojEg3XbJ9i5A:w9kOQWravIli27RViHsS+
- TLSH T1A0C833B055A581A562648CCF8B4CF34D9F82F0A9EB04EAE61E3D96623D7227C4D1C4F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2100 7zFM.exe Token: 35 2100 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Release-арp-x64.rar"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4232