Analysis
- user interaction
yes - max time kernel
1799s - max time network
1094s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/11/2026, 01:07
Behavioral task
behavioral1
Sample
HEU_KMS_Activator_v64.0.0.rar
Resource
win11-20260911-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
HEU_KMS_Activator_v64.0.0.exe
Resource
win11-20260911-en
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
out.exe
Resource
win11-20260911-en
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
当前目录添加到WD白名单.cmd
Resource
win11-20260911-en
5 signatures
900 seconds
Behavioral task
behavioral5
Sample
当前目录移除WD白名单.cmd
Resource
win11-20260911-en
5 signatures
900 seconds
Behavioral task
behavioral6
Sample
更新地址:微信公众号.jpg
Resource
win11-20260911-en
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
更新日志.txt
Resource
win11-20260911-en
4 signatures
900 seconds
General
- Target HEU_KMS_Activator_v64.0.0.rar
- Size 4.9MB
- Sample261102-bgzzysdh28
- SHA256 7e4f770fcf41ef71c6c20949b818193e16c76e68c664571a6316b4b8d22832e5
- MD5 61fef6ed4d40deef3323ce73056be53e
- SHA1 64ac05da02e86174238d2cf6112ab4145545fcd1
- SHA512 3bbff6a5425635bdd5ed9eefc0e80ebf0f85677e8d3461d3f3e7ac2446c3ac35a76f65464609b4553d0bfe120199a661668efc2e01ce031fbfc823ea1c473045
- SSDEEP 98304:8URd0CvhiHq2Rq9GKvOqzpaxIIAovniUjQQNYoRNcFYH:8CdSZR+jzpuF8Q
- TLSH T1703633BB117DB578257201F31A2CC349E78035E781B49824F9A169312ED6B2C63FADF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 636 7zFM.exe Token: 35 636 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 636 7zFM.exe