Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe
- Size 7.1MB
- Sample260822-ryblpazwdv
- SHA256 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7
- MD5 fcec3a6525c82308ab5d2a1de5e3ec16
- SHA1 10085e96cb9f8c9552b6130de2073da6a1297d19
- SHA512 7cbd5e7dd40a51d1822f8ab4735a0ca9394a07c056b99bc3cefe568cb3b32cb072c3e661f4e0dcfc4b661c6ee5fad5325c11c2e42c613e9cd8288ef8546a0cfe
- SSDEEP 98304:VHX6evqkEgTm1SuPC9sqs4PWD04P7qyTLIj7SD:1BEgSYLs04P7qq2SD
- TLSH T10A767D51F269C4F6D016C439C942EA5BC2B27C551BB187AF2050BB5EEFB33926C29B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe 5836 7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe"C:\Users\Admin\AppData\Local\Temp\7debe3e445cfd6836e302b72ed4a140de41ce0156680661ee9366cd33f9f98a7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5836