cb53a147ce93dbe5c7bb9a583d66a9f285906b89e21af6db57cdec57e384c729

Analysis

user interaction
yes
max time kernel
899s
max time network
541s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:25

Target
AegisShell.exe
Size 4.7MB
Sample260809-3ehrfach92
SHA256 cb53a147ce93dbe5c7bb9a583d66a9f285906b89e21af6db57cdec57e384c729
MD5 9cc758d9f97a8ec1fd62efb586ea909d
SHA1 a6676892c3d21feaa2115e02d004f141b29643b9
SHA512 658543dcc2c91f26a2f5c3a1452146b16c4a1ca7bef9db4450b0266619516015075729176d39b6bc2bad2833d535820867a3db14cab80f45d38392955f42d277
SSDEEP 49152:MbD0l4QnjVwG4SzvBJtd0EY7Lgx+//UZIRIW5bJT7OIuT7eT7e9bVroKJeq048gb:a+Rw7SzvX/yUU/UbD8ER
TLSH
T1BA367D02B75ADAADC01BC470835692735A26B0CB0F35A9FF55C855383F6AAF05F38369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1420	AegisShell.exe

C:\Users\Admin\AppData\Local\Temp\AegisShell.exe
"C:\Users\Admin\AppData\Local\Temp\AegisShell.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2712

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1932