Analysis
- user interaction
yes - max time kernel
300s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/10/2026, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
AlienQuest-EVE.rar
Resource
win10v2004-20260911-en
5 signatures
300 seconds
General
- Target AlienQuest-EVE.rar
- Size 2KB
- Sample261020-ltakyab15n
- SHA256 f7bcc8585cd3c7f10901e714707b7b22d68c5c7b6391207ac61c585b24089225
- MD5 bb0e92f125ee6525cee8ee74f6303106
- SHA1 cab01d76232842009572db7784ed0245a8035449
- SHA512 dec55c2c1f78d75fe3bdb04306a654ad497609a592499b2c738db6f1b4e2978be02244ae3d38c5528a026f3e0a7e664493eb2743010f47f8b00d81bf1b71c5c0
- TLSH T1C6515A49041AE3CE2D820A388E36232667ED05A2B4BEA101F99B272B5E8D3EC15411E0
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1276 7zFM.exe Token: 35 1276 7zFM.exe Token: SeSecurityPrivilege 1276 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1276 7zFM.exe 1276 7zFM.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2712 OpenWith.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AlienQuest-EVE.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1276
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:416
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2712
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Downloads\AlienQuest-EVE_public.CT
- Size 13KB
- SHA256 cd8c1e5d12fc745504b8a3e75d284ab47522f6e6b495818023f68edc8d130925
- MD5 073c99a285abf500445946a799103e26
- SHA1 c9c2068c50737e37b4a16176617001d7e3edc26f
- SHA512 604a58d7f62ca387ecdc0c150aac0aaa35551e8105d0c3ad0d8329d11e6670dd6b22dda4709e8102319952d72c9997ae44c30220347edaa81ffa056c8c42c649
- SSDEEP 192:77tftlto9auIaJbEO6keAX4Fab9UzvUxIN/P/pP+zF6a6dg6CwRpnY5eD9ByXb2:vtfpowQgs6ewRp/v
- TLSH T133521C4968C2F30A57B7424E8D66EC1CFD22530365968411B89ECB276F76EFC8863F60
- MD5 SHA1 SHA512 SSDEEP TLSH