1a157639b383419ed5edf69520c421f3bc2de64f08a00df69007be49f783dc8b

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 18:41

Target
Nature.exe
Size 3.6MB
Sample260620-xbt3eahz51
SHA256 1a157639b383419ed5edf69520c421f3bc2de64f08a00df69007be49f783dc8b
MD5 953a1326df779d73e4a139ded4141255
SHA1 e35163e3259e2fc4b748cf32a418f6f5a1a94713
SHA512 6fbe4ac82f5bc4fa96a1f2c43e6f9a3aa93d9ae3c022da477cb23ed1cc949d485cffceadc081007ae4283ecc03ddd878376d30c1fc6b864733bfa08bb25abbe5
SSDEEP 49152:y+U1AQ3tYa2xyX+G0JKTOr2WSNPXP11RAnFUeIp+mGTCDG2GrtsElKkegqzIL0o:4zOEjsu/zgpEG24xKkszIgo
TLSH
T12A06CF92F39141E8C667863C8663EB17E7367C051B115BDB3290BA252F33BE16B3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4196	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6124	Nature.exe

C:\Users\Admin\AppData\Local\Temp\Nature.exe
"C:\Users\Admin\AppData\Local\Temp\Nature.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6124

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4196