Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 11:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe
- Size 376KB
- Sample261018-nmmm2adv21
- SHA256 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290
- MD5 0cd504742aa00f7cd6c5914f8394ad7c
- SHA1 b62575747d70ae57f4f65ffbd1050ef36c3e9c02
- SHA512 b27193055505d49b0abfecf45682e33dca52eebb98c68fbe2f18fd5ab67b5ecb19812dcb54af7aea95e2e9975ca6981490b8ceea3eb3333d63052501ad19702e
- SSDEEP 6144:lQL4D9x2ytUNZcyjtV3jfyn3JiRopMa/chJbjgwxDkXU2rYNs:l+Mxiyn3Jiq1chJvgwxDkis
- TLSH T125842C17E7A358FDC677C17446ABA232B932F81805359E6E2794DF322E30D60952EF18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe Token: SeBackupPrivilege 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe Token: SeRestorePrivilege 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe 4232 b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe"C:\Users\Admin\AppData\Local\Temp\b332621d2c30d8a318950b90ccb16051df9329c4cc84eac4b1667c3f67704290.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4232