Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/10/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe
- Size 389KB
- Sample261013-2pkhcads4p
- SHA256 f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b
- MD5 31f536a18d6ee9438885a992e991af12
- SHA1 ea3f1edac6c40d8400aad29eb46663f0f84cefc1
- SHA512 32c3434b410c0d35c3aaaf09fe77b258fd5b543b8e8923e0b7a92fb01cd71dba6e46a38c63b5af960bf7eb1caf223d286d1a09d0bd62c5344dbdf232771b7b54
- SSDEEP 12288:M+rmjnd1bwViEgIW6Nt9wCF3d6Nt9wCF3:M+i7d5wViEltGS3otGS3
- TLSH T1CB84BF6676E56AA9DAFB9674C9760641FEB3BC404B31A3CF130046B90F316C09FB9712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiKey = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe" f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 476 f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe 4464 f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 476 f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe 4464 f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe"C:\Users\Admin\AppData\Local\Temp\f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:476
-
C:\Users\Admin\AppData\Local\Temp\f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exeC:\Users\Admin\AppData\Local\Temp\f33b34335bc6f6dd58e1c24b64f43bf377e9537533a9a5e2ff816603e197ef1b.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4464