Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe
- Size 19KB
- Sample260817-efjhcss1hw
- SHA256 bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162
- MD5 00f69f7d9e0c3d336d9b29b09761e845
- SHA1 b1eeeafde5fbdfa1edcd3a392767b35f42520e1c
- SHA512 20bcb8d2d3b1ba7a1811f9307ec41180d7499cb0570e8a7dfa2374d9855c308023f623202afb8dba97b31aaa920eed4f4c268032a85a2c8e7c9a3324fd2369ad
- SSDEEP 384:3J9cIufcTn6tCf7O2LsBSPjqxt+K0a56tjUpK7cj755vsY9fdB2:5uC6wSCsCjqxt+Kf56tjUpK7cjd/fdB2
- TLSH T1529238443BE98679EFADABB852F51B5082B1F747CA10CB4F4CC5409D2A72B448810BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 940 bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 940 bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe 940 bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 940 bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe 940 bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe"C:\Users\Admin\AppData\Local\Temp\bed9eea24e6dde8845559b21824a0dce6eeac3f57566b8bc8af9a71810ed9162.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:940