Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 11:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe
- Size 1.5MB
- Sample260802-m4yk7a1erd
- SHA256 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1
- MD5 60a8ec755458b9e1d1e21dcb3da9106a
- SHA1 163d01500bd4e3f257f8b944b5e912e8d095bfa8
- SHA512 40c0b1a5240e4a137d4ae22a4fadefcf40997abb1d61712da02a7d836dc12fb9cb3521b221872a9b6f85394462de377d4d536787ef742833782d1d94f9650d73
- SSDEEP 49152:5UNxvC6FGYJf6yjNQpNONZnTX5PlGPgq4EIxc7N/Xx0y7O/o:5ULC6FPYpNONhVPlEgq41c71TOw
- TLSH T1F075AE0733A6D0B9CF5790F5C5249A13FB3578191B2C8AEB24A05DACDFE7AA04B76311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe 4980 d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe"C:\Users\Admin\AppData\Local\Temp\d552d3981bd8876a1083e15300b894c2461f9bd87a1429d546bb1d7833a63ba1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4980
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\YourCrushLY\YourCrushLY_settings.ini
- Size 2KB
- SHA256 c4b2f3da76c799a801926de66085dbc69662a16db8aeb463c4ca3025d51fc5c8
- MD5 51eebde27f886c549c91f33cad0497f6
- SHA1 2a749965b8e0cdc76f004ff9ab500c52458ecb64
- SHA512 5cb3e1fb5d99d9124dd64b15b19eaae326160fe7bfcc786d863949852eb7de4ceaf41ff24edb6a207a0e1351e36deec498a6f709f68b3f70468148a15d000d5f
- TLSH T131516B1323F80969FAF75A84EFB855759B3ABD56091DD11DE2D0020E4AF1C5088A37FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\YourCrushLY\YourCrushLY_settings.ini
- Size 2KB
- SHA256 a01f77e848c96d46cada670b32a3d2e1fe91f303988a57f1f880e2ec6594a75d
- MD5 fd03cb1e812625ef1a04787948e585f9
- SHA1 706f7fc56b27682a7f5470828a7ecbf92452452c
- SHA512 9b80d471a1b328fad580a99d8ef0f7c8e8c3f7df7a2d77ab0fcee952ac1a24bd89a74791ced5143e51aa0fe5ec4e0a224f06c32e61430802fdea202c86482e09
- TLSH T163517E1323F80969FAF75A84EFB855759B3AB966081DC11DE1D1020E4AF1C5088637FF
- MD5 SHA1 SHA512 TLSH