576f3ff7e34e66f6298efbb5b9ccda4d2c27adeb9040ba9c85012c9f555f2d4f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 12:19

Target
file_cf7313a869b75634.exe
Size 8.1MB
Sample260626-phnvzabs91
SHA256 576f3ff7e34e66f6298efbb5b9ccda4d2c27adeb9040ba9c85012c9f555f2d4f
MD5 3fc4a02f1bbb142af490bb2d0d046cdf
SHA1 c8ade7c35ea5723eeef0d517fbbda2e8847f6479
SHA512 acc259439cc922ee4ce9310b8124302fd7510b1db5bcb9cb1d4879e888364e7c4ae495376e88085a4cfc12d4778aa1ee48c993ff49fb526c85f597acaa2b1fd8
SSDEEP 196608:N2ZxifyYl4j7L+iwJ7/8aRYJ+YVttiq6fIF8+SJDMIFgW:mx+Xl07twJ7/LY58TIF8+SpMA
TLSH
T13E863302717614F8E66BC138D3499B529B36309D0F364EFF225516282F36BE92D39F98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Suspicious behavior: EnumeratesProcesses 4 IoCs

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file_cf7313a869b75634.exe
"C:\Users\Admin\AppData\Local\Temp\file_cf7313a869b75634.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972

C:\Users\Admin\AppData\Local\Temp\file_cf7313a869b75634.exe
C:\Users\Admin\AppData\Local\Temp\file_cf7313a869b75634.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3972-0-0x0000025790490000-0x0000025790491000-memory.dmp

Download