Analysis
- user interaction
yes - max time kernel
568s - max time network
419s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/09/2026, 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Noise+.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Noise+.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Noise+/Noise+-README.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Noise+/Noise+-README.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Noise+/Noise+.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral6
Sample
Noise+/Noise+.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
General
- Target Noise+.rar
- Size 7.7MB
- Sample260927-qaf1tsydrb
- SHA256 129b3600ce09240332c971932b4a93dd1be7e6fc260e07d7c176a19fdca52e9b
- MD5 1123a8bbe768c49d789d7f990f473143
- SHA1 8f2e0ed679b5787909532efebb3c08a33951093f
- SHA512 035ea929fdd490bd912ccf41f23276ab0e79c7e1d21d0cde950ee0595f6fd968a4c2962495b1b7c0983a0671710bd76b5696e4b59ecb2a2e32651cb449bf08f8
- SSDEEP 196608:dIibEKVErp1cnqj1yscwVf3n4uXChu1UnqPj/zmhujf3r/g:dTbE2Fqpyux3n4u+u1LzqE/g
- TLSH T1CD86332C02B0FB967CF08D481FA56C068115C67F469476C4F9BCAE8E676B2A3ED1139D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.(^; OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\\ = "data_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.(^;\ = "(^;_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.data OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.data\ = "data_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell\edit OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ᶨﴎ㰀耀 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ᶨﴎ㰀耀\ = "data_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\(^;_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\data_auto_file\shell\open\command OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 8 7zFM.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 8 7zFM.exe Token: 35 8 7zFM.exe Token: SeSecurityPrivilege 8 7zFM.exe Token: SeSecurityPrivilege 8 7zFM.exe Token: SeSecurityPrivilege 8 7zFM.exe Token: SeSecurityPrivilege 8 7zFM.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe 8 7zFM.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4300 OpenWith.exe 4604 OpenWith.exe 4912 OpenWith.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4300 wrote to memory of 4676 4300 OpenWith.exe 91 PID 4604 wrote to memory of 1504 4604 OpenWith.exe 93 PID 4912 wrote to memory of 3352 4912 OpenWith.exe 96
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Noise+.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:8
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO80010EA9\.text2⤵PID:4676
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO80049CD9\.data2⤵PID:1504
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8007BD3A\.(^;2⤵PID:3352
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5228
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7zO8007BD3A\.(^;
- Size 7.9MB
- SHA256 ca8a8d80689fead22394716dfe776996b5aaa264277f805a2f33919b6823af92
- MD5 c0e9f7cfc9687d864611b32cb842081c
- SHA1 35053a2bfc4067e75b5de520b31b8268b8d340f1
- SHA512 f64188445a0f673019b9ff47c8d9aca949a8e05299f4639d127b30d9856635e7ead2e215da784a8bfcaf75372a3a5106d18940a055a24650741d5e686def2e2c
- SSDEEP 196608:GN16vlSN8PB1UesnxegsE1AsOd1FaFwzobCgX:u6tS2PBhsx0yO1kM0CgX
- TLSH T19D86334675CE952EC5A1C674D21510B8F20E3AC8CEB65A4B9F6B2709DEB3E31C07E742
- MD5 SHA1 SHA512 SSDEEP TLSH