Analysis
- max time kernel
899s - max time network
585s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-fr - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ETA.exe
Resource
win10v2004-20260513-fr
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
ETA.exe
Resource
win11ltsc2024-20260706-fr
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target ETA.exe
- Size 1.5MB
- Sample260707-ps9kesh13x
- SHA256 2b3f6ec7ddd2834ba78499cb9bd9de3d8501b2b457b78f497cf6639d5de2a360
- MD5 d9643f49f66991c56b661b9cc63eeb04
- SHA1 a5dbec499d8f7cde32a0997a520c63dd2f370644
- SHA512 50461d4bace9b95adeb7e67eb30dd47f052059230f1d24ca383358752c2d93457c4f5ff9e93777254d7afea7294c555a0d6abb10108faffa90a48fc80bacb106
- SSDEEP 24576:Ua35/EHdnEyKN+9cMEZ+8vxRWlGDPpkFALMT4xNjkvisbTFNlZvdimnKAHyv:3p8ej+9cPZharFALM+jKisvfMmnov
- TLSH T14975AF49E2E440FCD067C134C696AA1BE73574090B249EEF13E44E9A7F63BE25B7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe 5296 ETA.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5296 ETA.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5296 ETA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ETA.exe"C:\Users\Admin\AppData\Local\Temp\ETA.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3120
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:3572