Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 18:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe
- Size 1.3MB
- Sample261012-xgejxaed39
- SHA256 afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b
- MD5 13d4951859c4c39dec6a16c71181a9c2
- SHA1 b1f005082790650be60bf1cca3053b2cad0b223a
- SHA512 cb825cae62ac5d509783f94532e2e3981a32e43aaa551e38116c7910b29e7fd2e3233d22903c3caa1013059647e8d4a9c51d3f9987a5caeae1f5caff5cdd9d04
- SSDEEP 24576:4FPgBlke9EaKngL2jdshRTdG1YxITqvfPkbIcbjLm:4+aarSj8RoTCCW
- TLSH T19155BF66F6748331D073D1B9C5D2A68EED7230864B3189CB4286876C3E677E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe File opened for modification C:\Windows\system32\AppVClient.exe afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe File opened for modification C:\Windows\System32\GameInputSvc.exe afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4056 afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe"C:\Users\Admin\AppData\Local\Temp\afea53e3edfac9e90b8f2b87a9f76549cd3728133f29da4e9564b374638c545b.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4056