Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 02:35
Behavioral task
behavioral1
Sample
funny.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
funny.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target funny.exe
- Size 16.0MB
- Sample260723-c21mnafd72
- SHA256 99f8792756a34e0057d46fdbadc67f5604c567a69b5d59a71e5021ff1ce28244
- MD5 afb2556ccc6b842eef92a055c9562e5c
- SHA1 fd8e36492e9237a30dd330508d7b3c95c7e64ccf
- SHA512 cb0e310ac0a971e04972b56cddf1e514d2dbb47bbb3c67e0c80c1ca0d6cfb42d0e25202638c3a216825ef281553a83c3d00cb94ec1bd3f53592949d146f83f38
- SSDEEP 393216:1lNIZ37UJ32eivEoxy8IbWhP2EfWCDwXEAphVtpIwQSg+R1tO7vFgtR:1bS4ce2sn+7fWjRphFBo+R1tQvFg
- TLSH T1FBF633A8756574FFECF246389E99F862937374811B92C1BB17B05C2A1E2B2D41D387B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 13 IoCs
pid Process 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe 4920 funny.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4920 funny.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5164 wrote to memory of 4920 5164 funny.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\funny.exe"C:\Users\Admin\AppData\Local\Temp\funny.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\funny.exe"C:\Users\Admin\AppData\Local\Temp\funny.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\PIL\_imaging.cp314-win_amd64.pyd
- Size 2.5MB
- SHA256 d823c0e3b54035d08703bb427c553c956c2607b79395f2952e17a5447c5f1105
- MD5 c3b635739ab73615e5f25b5be8740ba0
- SHA1 1ff4078c87e91b32fa4f91cf127b2e7b1bbe7996
- SHA512 0717462a639b6b21eafb20e190f4fd704d22c617dd0ca39392f2cf7aedb0bd6ca159ec86b00aa47ffd74f99b100b76e6133f6d4dc13b641c7d8310c7a73b537a
- SSDEEP 49152:sltY4byAqCcu9833XDqGTsz3zVJxS75tbTtE4mxEH:CyAqCcnXuGGLOR
- TLSH T17AC57C42F5915899DA724034CDAAD622E3B1780D1BF186F7B684A7F93A33BD03937385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\PIL\_imagingft.cp314-win_amd64.pyd
- Size 2.1MB
- SHA256 93c3ca5a3e7119897be9825a0a4228d485410fc8f1e42257edf7e89052c79bce
- MD5 2731036b349c5edcccfd90de105edc12
- SHA1 3e7dc528d9f8f04f4a21da1781398c2ecc8a0aec
- SHA512 f8b0903471b65bf905db57a8230e6de4f60e41e6d654e6f70631b79c80a4b6ecf43a84f2d811ee4741335aecec281c4964688b796a01fa3bd3ce59d1d06ef453
- SSDEEP 24576:WhPxaDYIKlewlwk3VK+9Cle6JnbadSVwJNKiRjfIjTG2vSzGZHAGCl4tmeg5i5+:apqVw2MZ+rRiKQIQ74tm5i8
- TLSH T14BA5BF42E29641E8D93BC174C657961BE772B40413089BEB59D05A99BF23FF22BFE310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_bz2.pyd
- Size 85KB
- SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
- MD5 207d4a4b7a113ef494514918f2dccdf3
- SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
- SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
- SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
- TLSH T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_ctypes.pyd
- Size 139KB
- SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
- MD5 eeabc0c7756ed7a29e33e467c398737f
- SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
- SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
- SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
- TLSH T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_lzma.pyd
- Size 157KB
- SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
- MD5 cada2b240b280f172aeb32a1666b21e6
- SHA1 c15dc39329444433c255309eb89bae188aae1b22
- SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
- SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
- TLSH T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_socket.pyd
- Size 85KB
- SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
- MD5 7a16a21ad11d3e9829ca3b379a2bb010
- SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
- SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
- SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
- TLSH T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_zstd.pyd
- Size 491KB
- SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
- MD5 035b0a033dd00dbe887556f4d4b852c3
- SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
- SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
- SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
- TLSH T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\base_library.zip
- Size 1.3MB
- SHA256 bfb76c7b7f50fa5e20aacac688af99425460e0c44a3c3a67ca506683a6006842
- MD5 6467fea1e8b795cc5817a24d259e4fb2
- SHA1 f8f4432c871ec96df9badfb2fa549d330ed0ad70
- SHA512 8ba5239decd4868361a251f714b875109d6caabbc6b6ab9110496f5e42c3508af937340a0697b5cd3d13b19d4a562d004519b83ab0fd885283f5624780d06a7a
- SSDEEP 24576:Q4d0Y5lbndQZWLHHhQeOdP2m2df0uUFHRp8R:Hd0Y9T/cuUFHRm
- TLSH T156552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\psutil\_psutil_windows.pyd
- Size 69KB
- SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
- MD5 0a66d22d2ac4f9d41e1605b8d05de77b
- SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
- SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
- SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
- TLSH T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\python3.DLL
- Size 72KB
- SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
- MD5 a5495a547b4218148914469f1ee65d47
- SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
- SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
- SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
- TLSH T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\python314.dll
- Size 6.5MB
- SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
- MD5 006b0746b5abaf438d1bc753261c6d2c
- SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
- SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
- SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
- TLSH T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH