Analysis
- user interaction
yes - max time kernel
50s - max time network
3s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/08/2026, 20:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cresiwa.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cresiwa.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Cresiwa.exe
- Size 16.9MB
- Sample260824-ys91maywe1
- SHA256 b597fb023263aad7ab20f45fe25cc5ff57dae178206e0ff097e3fc9d84c68115
- MD5 8fe583b65aa76270f33dfdbcf4127435
- SHA1 c1557a5e7d698a55c0f8404accdcf8cb1afb1dc2
- SHA512 1e4bd8ee8d33244c36b15f202eb04dbe8d168177ad70d4abe3069680a34f72c70fa8012770f102eae7a97319082df7c6220e9cd7c3f4a669b249c686be6d5e87
- SSDEEP 196608:7EpfTGe6LL0An6Ge6LL0An7dyAJCIxG2ovEKFOeYP7agIGe6LL0AnYdyAJC:7EUe6Bpe6B7dyAB7oHFQlDe6BYdyA
- TLSH T1E007D08EE3FE4976C2A3D3794E60B3225D6438691211AFC79F88CB0D1A351D0CEF565A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe 3200 Cresiwa.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3200 Cresiwa.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3200 Cresiwa.exe