Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe
- Size 627KB
- Sample260925-nlntpsvcla
- SHA256 efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669
- MD5 55ba25ea6b060f6487ad8e8aaf34f6c6
- SHA1 de4a0c9884f2ed953701645a3fb89efa9e4a3d9d
- SHA512 e1d7b4e37c5a383858be641f994dde07650643a6eb20e20fe9c49e8a956a5a16886719e1be3694676ed85ea0aa237081ed1cd1690dee16224629515ea2e73caf
- SSDEEP 12288:NOvv+ri6oFUuKXZFK3Y+prIXW26CQdBQXkDFfEjWaYS5whKv9TsC+usW:NHvrZF7fsuXkR8jl5w6TsWL
- TLSH T1C1D4E028FDAC40E5D025CE3FC2791601AB65F6225B31EEDB067806513D22BBD5D3EB82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ShareX\hyaerstoiast.inf efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe File opened for modification C:\Program Files (x86)\bothersome\tiaostious.txt efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4392 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe Token: SeShutdownPrivilege 4392 explorer.exe Token: SeCreatePagefilePrivilege 4392 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2448 efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2448 wrote to memory of 4392 2448 efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe"C:\Users\Admin\AppData\Local\Temp\efd9c53cbbec73120a2bbf16c553d5439356876f997a890888cb4e87389b8669.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2448
-