ca984c96925deeb83e7d3fbc6ff4d807e49abaeab34921ef6843f7382e1f7672

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 04:26

Target
$PLUGINSDIR/app-64.7z
Size 98.7MB
Sample261023-e2gwnawvft
SHA256 ca984c96925deeb83e7d3fbc6ff4d807e49abaeab34921ef6843f7382e1f7672
MD5 d25c1923c73d16c8eb0537c71e2dde50
SHA1 2118ee1cfebe7d967250d2199ac2cbdfd9020214
SHA512 f4d7b3ef1bce1c0449dce4aa2c1ba0577b7b48f8e4fb1f2d434d5ed64d5fda4a9249d44364b0f9d1b05589bec6b76e212f506d78defc1790f6cae61c7e4136cb
SSDEEP 1572864:FOLNwhz55vhpvpy2uB7JprByC+h65j3eD8471g30j+rQiw6CIKWRTqci:2Ot/Y7VuIU5BgRr5XKI7i
TLSH
T1A538330B1320D12FE055B37DCB8BA172630A4F1B0E04E4BD4265EC72A6B5169EB797B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5244	Melty.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3572	7zFM.exe
3572	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3572	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3572	7zFM.exe
3572	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 5244	3572	7zFM.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\7zO4FDAA37A\Melty.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4FDAA37A\Melty.exe"
  2⤵
  - Executes dropped EXE
  PID:5244