Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 07:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10ltsc2021-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win11-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target setup.exe
- Size 18.7MB
- Sample260729-h8p3dsfa39
- SHA256 376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88
- MD5 f5cb2ff0db067434db4f3f1118e2eb2e
- SHA1 7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752
- SHA512 6ba081dc8e9aef3bac08ceb92b3b5c2352e2cf2e96a66de13b5faf46712467baca2650e5e0c08f426b864d610a5ecc1ac49dea70acc00e66ef1f5a5bc21a2aea
- SSDEEP 98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop
- TLSH T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5556 88cab8345c536ad243be51858f1282d1.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3896 setup.exe 5556 88cab8345c536ad243be51858f1282d1.exe 5556 88cab8345c536ad243be51858f1282d1.exe 5556 88cab8345c536ad243be51858f1282d1.exe 5556 88cab8345c536ad243be51858f1282d1.exe 5556 88cab8345c536ad243be51858f1282d1.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3896 setup.exe Token: SeDebugPrivilege 5556 88cab8345c536ad243be51858f1282d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
C:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exeC:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5556
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exe
- Size 18.7MB
- SHA256 376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88
- MD5 f5cb2ff0db067434db4f3f1118e2eb2e
- SHA1 7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752
- SHA512 6ba081dc8e9aef3bac08ceb92b3b5c2352e2cf2e96a66de13b5faf46712467baca2650e5e0c08f426b864d610a5ecc1ac49dea70acc00e66ef1f5a5bc21a2aea
- SSDEEP 98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop
- TLSH T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\88cab8345c536ad243be51858f1282d1\agent.json
- Size 399B
- SHA256 c9c97aaf3b02759665f54a009afa09f19c30874820c7561132b3a93ab95c893f
- MD5 aad6293dba11b0850dbdfe52a8a765f4
- SHA1 1497af259a99dfd6932a6771c7e53026a9380006
- SHA512 aa054c9e54b063eb96ce553e65478188882381ae3f2700799bf5600e89c2ae61ab9eeb1b2f716d512a966a1f3cdb775a534fee085b963edc62f3451d425e0132
- TLSH T1FAE0F1144240F1B7C6F1A57C794E5D050ED0D918CEA513A82D82F7B04501D4200C5789
- MD5 SHA1 SHA512 TLSH