Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
29/07/2026, 07:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10ltsc2021-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win11-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target setup.exe
- Size 18.7MB
- Sample260729-h8p3dsfa39
- SHA256 376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88
- MD5 f5cb2ff0db067434db4f3f1118e2eb2e
- SHA1 7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752
- SHA512 6ba081dc8e9aef3bac08ceb92b3b5c2352e2cf2e96a66de13b5faf46712467baca2650e5e0c08f426b864d610a5ecc1ac49dea70acc00e66ef1f5a5bc21a2aea
- SSDEEP 98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop
- TLSH T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 60 88cab8345c536ad243be51858f1282d1.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1176 setup.exe 60 88cab8345c536ad243be51858f1282d1.exe 60 88cab8345c536ad243be51858f1282d1.exe 60 88cab8345c536ad243be51858f1282d1.exe 60 88cab8345c536ad243be51858f1282d1.exe 60 88cab8345c536ad243be51858f1282d1.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1176 setup.exe Token: SeDebugPrivilege 60 88cab8345c536ad243be51858f1282d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
C:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exeC:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exe
- Size 18.7MB
- SHA256 376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88
- MD5 f5cb2ff0db067434db4f3f1118e2eb2e
- SHA1 7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752
- SHA512 6ba081dc8e9aef3bac08ceb92b3b5c2352e2cf2e96a66de13b5faf46712467baca2650e5e0c08f426b864d610a5ecc1ac49dea70acc00e66ef1f5a5bc21a2aea
- SSDEEP 98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop
- TLSH T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\88cab8345c536ad243be51858f1282d1\agent.json
- Size 399B
- SHA256 a099b3130bf2f1623be82ecfb0b2bf34fc8297cd65ec77201e7365a142af3eb5
- MD5 66bc8bd8bc07504d6cc0ecbf8ee37447
- SHA1 d3ae4292148fd2691f2b5187f76fac664fd40a58
- SHA512 b47c0ec42e129da5cb402a0287b08114636b744af92e63545c0fced41203b45715819c02458fd87d258fbbeccd3954dc42767f59386c92b657d96647af835317
- TLSH T12AE0F888D08200E2D06C163C8BEBBA4A38D78C3B47A703E2E4F098660982A49B073B00
- MD5 SHA1 SHA512 TLSH