30ee23a2e75a27ffc5a4531611a831dc8692db202d0330dfcd7707e634b14afd

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deathware_cracked.exe
Size 19.2MB
Sample261011-pc89qahe87
SHA256 30ee23a2e75a27ffc5a4531611a831dc8692db202d0330dfcd7707e634b14afd
MD5 6e2fa806cae0c24e923872146bcd5ec5
SHA1 30b6494dc674f714a24ea72bcd66c86112f1ce58
SHA512 10c293120bb8e9b80b0de2b80c60059683a8fdd81ebb967789c0377aa5e85fb76aa093864e74b229e15d2d1addac6daa2c930121180bb30053c54064c04a2844
SSDEEP 196608:TT+xkloWHLy1pMq7Hpv+ucLdr9kma5J+cEvwdAFNxL:fjloCO1pD7BcV9kn0cEvwdAF
TLSH
T1AE17AF0B77EBAC6ED207C5B4830543675A11B4CB2F26A5EB90C465397EADBE04F2CB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4368	deathware_cracked.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4368	deathware_cracked.exe

C:\Users\Admin\AppData\Local\Temp\deathware_cracked.exe
"C:\Users\Admin\AppData\Local\Temp\deathware_cracked.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads