Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe
- Size 1.8MB
- Sample260710-qnae7sct41
- SHA256 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f
- MD5 9ecc06dcdc8bfc9a82c5017800a86d28
- SHA1 c34f65625268f1ff1441befb87ccb4dda48fe439
- SHA512 f2a07badba8733eea63f7a442c9cb1b2eb9043bad248094a2eda8c4b044d0903d685322e3038ebdaad0e4c29ec81edf56e02e5095b50a62b86d9dacebbb36b5d
- SSDEEP 24576:3g2Ig2reoUdeaR23P9p1sPID2AtB5C7pliTPV7QfkqcPUmEQs:3g2XoeeDJsPID28n7Qfkq8ZRs
- TLSH T11285AE22A6A841FDD1A3D1F8CA268943E776784A0331AEDF03D456672F277D44E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 6436 3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe"C:\Users\Admin\AppData\Local\Temp\3a57fa13433ece2c134228afb1d9cd7dff500a421ca19867140230836e98a78f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6436