Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appFile.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
appFile.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target appFile.exe
- Size 694KB
- Sample260919-s8ydwagh49
- SHA256 b688b171ff1130bc5c7bd4b1d4356ee397bf593656a7f47c086b86029190e37e
- MD5 6d56ef04d909e160704556f54070bec5
- SHA1 af89f13fd7d557a6c90c39a4970e60c6340d3946
- SHA512 0fd2ba1846c38ee756e07db148802fc4cd03db141b8de5b1c0e936a7e4c6651dc9830467b9541557d8491c865dc81e78e5ec84c1157018344b018f3e86d61835
- SSDEEP 12288:iZn5OhuJ1V/eyRR+m1nRLv02xSw+9iKFDyxiYoQUuv4:iZn5Wu3gm1nIr9iDwRQUuv
- TLSH T1B1E401497FA686FDC9B8803119A48572F4B7BC5E0755C8FFC3A549080E6A2F86D3C792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Google\qiouwnety appFile.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3332 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe Token: SeShutdownPrivilege 3332 explorer.exe Token: SeCreatePagefilePrivilege 3332 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4112 appFile.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4112 wrote to memory of 3332 4112 appFile.exe 80
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\appFile.exe"C:\Users\Admin\AppData\Local\Temp\appFile.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4112
-