497c76429dcee74672d8e097917dfd1db18cc3aef17c8e635de546f9260e9185

Resubmissions

29/07/2026, 14:15

29/07/2026, 14:03

max time kernel
164s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 14:03

Target
Gen-Adb/Binaries/AdobeGenP.exe
Size 1024.0MB
Sample260729-rcwpqshd64
SHA256 497c76429dcee74672d8e097917dfd1db18cc3aef17c8e635de546f9260e9185
MD5 7d76e4be93b5e01ccd48feeb691c3bcf
SHA1 cf23695605c3edf8fb6e38708301f4d3c8ec9534
SHA512 d6c2cc775a32d569057cd5cddc05944814579884ec05a1f0f8f34186cab65e1b98c713d01609c6ade61fe4eec0c2fa3a38bf48c0111c33042b60c83eec815c85
SSDEEP 49152:N2EYTb8atv1orq+pEiSDTj1VyvBa8Heqta7x:MXbIrq4to
TLSH
T1D0B98D0973A442ADFEABE176CA13C607D7B17C460277862F01A46B766F337715A2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4904	RunAsTI.exe
1640	RunAsTI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	RunAsTI.exe
Token: SeAssignPrimaryTokenPrivilege	4904	RunAsTI.exe
Token: SeIncreaseQuotaPrivilege	4904	RunAsTI.exe
Token: SeDebugPrivilege	1640	RunAsTI.exe
Token: SeAssignPrimaryTokenPrivilege	1640	RunAsTI.exe
Token: SeIncreaseQuotaPrivilege	1640	RunAsTI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4904	4312	AdobeGenP.exe	89

C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe
"C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\Temp\RunAsTI.exe
  C:\Windows\Temp\RunAsTI.exe "C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- - C:\Windows\Temp\RunAsTI.exe
    /t /t C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

config.ini

Path C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\config.ini
Size 7KB
SHA256 3709022a13f41251621c34aa2ad72301aad4d5b1ceb8a5095a3fcdaedbd73804
MD5 f2ef246f608df6970968fbde300ca7aa
SHA1 aaf320a2b157665e470e1fba69fb80ee61c270a6
SHA512 bf3a02837e74475b7494382729aab4462fd60f122cd3d353219fbd1eb371fb11adfe5ea70600d6af45423363290a54b9cf617f2a6a63ddaf810ac8344d072654
SSDEEP 192:m+HKYNvcgBYjmsvcgB5VBotrc6xv2ctKgm8hJV:m0KCvcgyVvcgzL6N2ctKgm8hJV
TLSH
T155E19446C5C78793CDD4AC2E3272BF93223AF2ED41CF0A51DB564A3E229544891A7E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunAsTI.exe

Path C:\Windows\Temp\RunAsTI.exe
Size 26KB
SHA256 a3e0ba70ba908de8a75825c3a1ff36147e02c686280993c2caa8a9a6968764b0
MD5 80454e70784f1ddb0c91d41469e2498d
SHA1 2f3f04ef670895de12cdfbae17c9d427e7caa97a
SHA512 709ed0fc9e2520a5beb57379e90be12cac680060b4c72ff50e9d9897f3a4d7a57f84b9be04b78974e6f6b73cda7202bfc617835cee3011eed7f0ee6f5e82edf7
SSDEEP 384:8ZKqqO+5wZY//IfBbSh2u3JZEV065fC7iwUUukfR3lacMWkNgWwCy2nYPLN:+tqN5YYUBmcu5C6HrNJUbgWwCZC
TLSH
T1D1C2E71BBB9540C4E3A6C474CBB69635B5B0BD711B11CBDB93B432461E31AD0EB38369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download