050e8d7370b7221e98c28d24f1c9a86b4d9f8471670cd2755beac9756fe771d2

Analysis

user interaction
yes
max time kernel
0s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 12:19

Reason

Machine shutdown

Target
virus.exe
Size 1.2MB
Sample260716-phay4sgz21
SHA256 050e8d7370b7221e98c28d24f1c9a86b4d9f8471670cd2755beac9756fe771d2
MD5 ab62cca3c36b5594f52a8e88e392d746
SHA1 b8987f5f3bd24b36079fade02a79bb38bf3a8ce6
SHA512 fd6bba5131a60d7d849168ec773131150e92b11f66843539340a75dbf9c1f312a20b34f725b72ce90e64e1414d8265521d4a2950baee116de734a8eb050e5245
SSDEEP 24576:GJpPoc/p8xGsXgwxBFSGA4PEDSoSJ//CN4WaGjNhc61:6pPoZGUowsDFN4WaG/c
TLSH
T115453B17E26355ECC57FD17486579B72FA30B41941347E6E1AA8C7322F32E609B2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\ms-settings\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\virus.exe\""	virus.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\ms-settings\shell\open\command\DelegateExecute	virus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\ms-settings\shell\open\command	virus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	virus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	virus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\ms-settings	virus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\ms-settings\shell	virus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\ms-settings\shell\open	virus.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4576	virus.exe
4576	virus.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	virus.exe

C:\Users\Admin\AppData\Local\Temp\virus.exe
"C:\Users\Admin\AppData\Local\Temp\virus.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:976