Analysis
- user interaction
yes - max time kernel
300s - max time network
290s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
suspend.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
suspend.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target suspend.exe
- Size 1.8MB
- Sample260801-b151bavekf
- SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
- MD5 82b7bed3173a249d84355790a10c6013
- SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
- SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
- SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
- TLSH T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 suspend.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c0000000100000004000000800100000f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 suspend.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe 4340 suspend.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4340 suspend.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4340 suspend.exe