Overview
overview
7Static
static
3CheckERB_download.7z
windows10-2004-x64
1CheckERB_download.7z
windows11-ltsc_2024-x64
1Custodian.txt
windows10-2004-x64
1Custodian.txt
windows11-ltsc_2024-x64
1checkERB_d...le.exe
windows10-2004-x64
7checkERB_d...le.exe
windows11-ltsc_2024-x64
7checkERB_w...le.pyc
windows10-2004-x64
3checkERB_w...le.pyc
windows11-ltsc_2024-x64
3chromedriver.exe
windows10-2004-x64
1readMe.docx
windows10-2004-x64
1readMe.docx
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 13:28
Behavioral task
behavioral1
Sample
CheckERB_download.7z
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
CheckERB_download.7z
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Custodian.txt
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Custodian.txt
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
checkERB_downloadfile.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
checkERB_downloadfile.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
checkERB_withReport_downloadfile.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
checkERB_withReport_downloadfile.pyc
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
chromedriver.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
readMe.docx
Resource
win10v2004-20260911-en
Behavioral task
behavioral11
Sample
readMe.docx
Resource
win11ltsc2024-20260911-en
General
- Target CheckERB_download.7z
- Size 37.7MB
- Sample261027-qq67ysdf69
- SHA256 a6f20e138af5fd4a578ec3400709a39d58032096ec104f62fa9db1244ed00357
- MD5 d0ab6d76910a247c161f9617b7ff58a6
- SHA1 9c7d6768f26dab389f7f43b6ed97f9c24d800edc
- SHA512 d19e44faf7b28b9bdf29ac4bb8950eb9c98fa743ebe778fdd1b493e7171608b970a163793556ad377c1354b9aa5ec78dc17dc5cfbef641c38e48d713ec2dfee2
- SSDEEP 786432:bu4d+Rls835Cq8RXuobiaVXrdduNtdULyYcJOeiFuH9LirH8hbytg/L0h:ATpKpbiaVXsriwHI+agAh
- TLSH T1A68733BA123E7AA148FDAEB05F831E6BD20DC5DDF0BEB1F60694773014867976134688
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4680 7zFM.exe Token: 35 4680 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4680 7zFM.exe