Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 11:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe
- Size 1.5MB
- Sample261017-m7sjcaet9z
- SHA256 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7
- MD5 7a5e67e13b00a1a36ff01a6cf95b01d0
- SHA1 fa3058744c1931ff4e001a6081d92a2243d8747c
- SHA512 196fac9bdf3604c8bebfbd6ea418c7896ff60545bbe516e0e6054a24f937dca1f90bc18ee9e20aa6c02f000d5519f2f8785952cd6ed9ad8b9161013bb62eeceb
- SSDEEP 24576:Bujw9Djq8n/Lm+CBI6Y9LJmU4Yv/elmkFTVTg8dkGJWS:BujEjq8n/LmVBIt9hp/ydVT/GGJ5
- TLSH T138655C146D580AB8D8B6C4B48B730807E5327C09933559EF4A89BE2E4E33BD6763F752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5196 096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe"C:\Users\Admin\AppData\Local\Temp\096eabe9b6543b4d666f3efa08431685367531dd074fe8c1f7c12803d87979b7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RC$D.392.944\HaoZip.stat.lock
- Size 4B
- SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
- MD5 f1d3ff8443297732862df21dc4e57262
- SHA1 9069ca78e7450a285173431b3e52c5c25299e473
- SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
- MD5 SHA1 SHA512