Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe
- Size 68.6MB
- Sample260629-ppxrfse18l
- SHA256 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2
- MD5 5b4ebfbde2b178008861d44cccff8a98
- SHA1 e38e99934c62e6066075d8c21c4894e97dcc714a
- SHA512 bc34a207aa1aba8b1b9ce2eb6bdf475420c878ada092cacea96c966c84ab7dfb0ddb54081ac706655b5ac9d8e148b2afec0054b0d856b0740cb590cfbd1a977c
- SSDEEP 1572864:L/xBXaNZ5EMSA1MG3YfjfT112gGZSZj7k54mgTfl4qlXs:rxBXWU2M+qu0P83cc
- TLSH T152F72356E2F900E8D5BAC0BCC5975627E7B2345513349BEF52A48A652F33BE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 5416 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe 5416 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe 5416 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 5416 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5416 9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe"C:\Users\Admin\AppData\Local\Temp\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5416
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2\9A0yUres1v7a\D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2\9A0yUres1v7a\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 00b7947c843a7564a0b168ed46abfdb87f6aa6bac8ca1bb277760f872c82ff95
- MD5 794a50b30d205bdee8527554890aa7bf
- SHA1 bbbb200b935a420cffe4f2fef0f2f79bd6e6279d
- SHA512 5b8c55c8b492299114ad7dd27e9bb45395e03d76149787735fdf04ad444bfefddf785f51907a9355fe8d4215511231aaabd1ef3269025da9654ae59606107363
- SSDEEP 24576:Ml8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg9b:MH6emPXrYCqX4T3Q1Niqzc74xb4izMpF
- TLSH T1DB453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2\9A0yUres1v7a\wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 07c3631d158122ac48110bf81b1f67aa80c6965c8996ac1dda534b2766970b83
- MD5 891d037da66271ed9cbbd5e6a1fd6ea5
- SHA1 b9f1dab4c16f52e0c94cfab8cca789b3623c98ea
- SHA512 08ae2897c33dc761c9290342b27e64522d51d4e95f486cda0c2f0783e57e0c085bf83e7a35e437b0b5d912119273831a7ebf95542dce5992e9c3c595e5c7f030
- SSDEEP 24576:+7vme1ahPZ9dNv2A8KBlnNUrb0AbDRV8mSu+vPzTy7nfPq44LwjlViIthU:Aa/HNv2ulnKBPRrP+jTy7fPqmVishU
- TLSH T102955B4AB6BC40EAD47AD23CDAD7961BF2717410276197CF23A0479D6F27BD00A7A360
- MD5 SHA1 SHA512 SSDEEP TLSH