Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target _01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe
- Size 449KB
- Sample260604-sd9tesg19z
- SHA256 01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4
- MD5 3a91156c46a8b3b9a0591c9de52a8a73
- SHA1 736b0424d22fc20894b24eb10a75ab90fade562f
- SHA512 c4a196d898967dca3062378d741253f08e098d9e8646adb7ec1e08d1c0bc160e651be1182968e29182e46b3dc75023bc48fa3560a4d174828e1ad55ee968cf54
- SSDEEP 6144:XU+OgPI8/doqtkTi1hefPW5vVWRBVyPH9BH4eKZQIc50U2MhkgVCx+n36GBdPi6E:XrOgP9lhtkVgPYBuHqUbR8+nqQBpK
- TLSH T149A46C56F65614FDE46AC07483478A22B972B8850B35BDEF02E4C6313F66AE16F3CB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Sysmon64.sys _01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2332 _01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 2332 _01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe"C:\Users\Admin\AppData\Local\Temp\_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2332