Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe
- Size 569KB
- Sample260825-2ev64azcnf
- SHA256 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50
- MD5 88be6bb4fcf5256773ff9fa0bdc887cf
- SHA1 74e259f1539434b52cd61959bb9a1a59e6156a97
- SHA512 846af65aa3d13eead8f64a4dd7fb7e5bea4cfca413fc3968d8ebc84194dc2f0fcba3a5dd2a888d45a0ae6f8c5c75fb2f2387376418c72f6edb67528f177bd6f2
- SSDEEP 6144:3qZmw71gor303cKFD1P5RtZPSspCxfGR2PKgZEeGdzvZYSju6xKHt:SOc303cKFDB5RtZPSsp+fGRvgZDaCHt
- TLSH T147C4ED01A3FA8904F5F3BB7869BA03D55E76BD656F34C24E4B09654E09B0EA0DE34723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe 4684 245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe"C:\Users\Admin\AppData\Local\Temp\245e7a01cb729a20743f2cd3363f1c76fa8e0fbe8eefa53513dbc6008faf6e50.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4684