a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe
Size 3.0MB
Sample261002-v5gcassarc
SHA256 a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253
MD5 35d2c5b1b0e00d2750404791dbbafe7c
SHA1 8eb14e74f07c638b0f6396b15c4c449c7616fdd3
SHA512 24ef6a84abd9013cfc2dd518dbaf40c89df951ff17fb744c0430778b9a36f7419bd72be1bd629ea2d7d78db01a54341e632539d9426b7144f109b340068e6e28
SSDEEP 49152:KRPjwsF5syGw52OXZmO4dGGhyo8SoxgQ5SOshmztlssy2CY34k40inwWTgFnOLXH:oF5syGw5dpmLHyAQSOFtlJHCYihnwWEc
TLSH
T130E5234593D508F6F9AB463CE566C02DC776B8210770C8EF837495392E2B7E06B39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-0-0x00007FF6BB4C0000-0x00007FF6BB695000-memory.dmp	upx
behavioral2/memory/1096-11-0x00007FF6BB4C0000-0x00007FF6BB695000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1096	a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe

C:\Users\Admin\AppData\Local\Temp\a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe
"C:\Users\Admin\AppData\Local\Temp\a3916bf1f9ce6232a4890a3dcb61c6d2c6457c11bacd4529a025f736f81a8253.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x00007FF6BB4C0000-0x00007FF6BB695000-memory.dmp

Download

memory/1096-2-0x0000024CD9730000-0x0000024CD97B3000-memory.dmp

Download

memory/1096-1-0x0000024CD9730000-0x0000024CD97B3000-memory.dmp

Download

memory/1096-9-0x0000024CD9730000-0x0000024CD97B3000-memory.dmp

Download

memory/1096-11-0x00007FF6BB4C0000-0x00007FF6BB695000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads