Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe
- Size 2.5MB
- Sample260703-rvmvjsaz6w
- SHA256 bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892
- MD5 eaa768f55336df6c4d79a8985ffad8f4
- SHA1 1e2d6a999302e9d12329c1201544f56a3bb1738a
- SHA512 8ee7bf3b010feac2bef4970d3fb4b792fde9fd55e1085ffaf1da372c3dd090f1f3fc9a5350a85664634540ebd09c2058c5639a9d9420b60334feb55911cdabbe
- SSDEEP 24576:wBRPupbZD6PCJTQMVfRZyplVHaKPw0DzqC8LHkCgrnl4ydP4erIZvY4n:wBRmpbZD6PCJTQMgp6Uw0Cjabamq
- TLSH T11FC54903BE9048E1C06A62328D2697A57730FC486B2253CB3AD0BF7A7EB6BD15D75354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5292 bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{93B981AC-EC34-4785-954F-A670F94EA6BE} bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5292 bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe 5292 bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe"C:\Users\Admin\AppData\Local\Temp\bcdc0ebb805b5c83cf0a3f77e31e9e915bb7d96ec75823afca3c7831dfccb892.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5292