63a44c815d0fd672a513de97ea5ec93cfc0b7589e0ec24e3a0b628c7ab047670

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
22s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Infinity-Free-Beta.rar
Size 30.6MB
Sample261030-a7eahavv8p
SHA256 63a44c815d0fd672a513de97ea5ec93cfc0b7589e0ec24e3a0b628c7ab047670
MD5 2d3bc27ed2831c5bb389bc9a6fd3416b
SHA1 736e0ab643cd57deeb4c082fe1fcb3e052adb260
SHA512 2e2e23b2c4f58636ecf58b315eea4441782d032e98cb7c9a7d67fdc1ec47f34cb0ba4853426a5a28aea84a65a7c26c8f6357a59a8ffdb85f1c28e55e539d5d13
SSDEEP 786432:kX6srNwpXyb0G05pFz7b6muD8jIiAGnqcaVlgqDTf:kXBhwpvG8H7b6my8UiA5VlZHf
TLSH
T1EA67331946B23B0DA674B1978779FA06B2A14084B5522B7BE7CF9EDD08E731F4C71C88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4724	Infinity-Free-Beta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4724	Infinity-Free-Beta.exe
4724	Infinity-Free-Beta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5380	7zFM.exe
5380	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5380	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5380	7zFM.exe
Token: 35	5380	7zFM.exe
Token: SeSecurityPrivilege	5380	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5380	7zFM.exe
5380	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 4724	5380	7zFM.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Infinity-Free-Beta.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Users\Admin\AppData\Local\Temp\7zO4052090A\Infinity-Free-Beta.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4052090A\Infinity-Free-Beta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Infinity-Free-Beta.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO4052090A\Infinity-Free-Beta.exe
Size 34.9MB
SHA256 39af02aa4577747a15d49bb22d75fb5494ae37831cf44e9a49827ddb2597d758
MD5 2f925fbeaac4140832df34d92acbe256
SHA1 943d0d91ef84989a70a62c3124926bc9c825345c
SHA512 284a356c81af37cfb880e9988da82dc4c0454a814dd1b081c417afdd3368fb51fd006e48eef6527f1282459cfa58f0820b1c33f9f3f83887c06c6a7eecd3da7c
SSDEEP 786432:9Q+nzwD5MOL1remFsfZA1mu+9OS2mp3ZBw9:9nzg5MCFOZA1a9xdZBw9
TLSH
T1BD872367A9C863B4C4C35544A29F465F63C1D57AC2FF8D1827CB2C023A12D674A4EEBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download