7a4d64099628f09fa5b2e3b9481fc9b4510e03c3ac3c67ac045f0e52e7ebf628

Analysis

user interaction
yes
max time kernel
141s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
23/05/2026, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SF-Verif.exe
Size 5.3MB
Sample260523-xq2e2ab151
SHA256 7a4d64099628f09fa5b2e3b9481fc9b4510e03c3ac3c67ac045f0e52e7ebf628
MD5 9358dedc5d75d21ee9d1e9b43a3ba140
SHA1 9e9e97aa928147fa5af1b4f56a19e1219b067b74
SHA512 4a93c0da5782a31c97b38681bcef89766a8efebfe37a00869a7388566603c2927770ec8f85cf3c5b8cdb1e4d4ab589b33160ee87faa408e613c0024296d03963
SSDEEP 98304:bh83Eofnf7TN+c8Wl6B+Ip9L1P00wbPRTiZfI8E6dnH:bh83EkTTN+c8WlIxhP0VROZAR6dn
TLSH
T1F246F13AE715085EF02B837B8552D3A2D5713E80E73566F706B06E53BEA35C14FA9E80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1964	1604	SF-Verif.exe	81
PID 1604 wrote to memory of 3692	1604	SF-Verif.exe	93
PID 3692 wrote to memory of 4992	3692	cmd.exe	94
PID 1604 wrote to memory of 4080	1604	SF-Verif.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1964	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=60 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\mode.com
    mode con: cols=60 lines=10
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause >nul
  2⤵
  PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads