082d6ca4d70807c10d999561e27af171d3074ea76932752348c33de6e0aca851

Resubmissions

23/10/2026, 21:32

23/10/2026, 21:32

user interaction
yes
max time kernel
12s
max time network
13s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 21:32

Target
hack.exe
Size 170KB
Sample261023-1dr8daz1bv
SHA256 082d6ca4d70807c10d999561e27af171d3074ea76932752348c33de6e0aca851
MD5 3c5d8b91292de879bd5073c96aa19760
SHA1 b6b16e8c1459c9b8851f71a9c02fa41e0aa93a5a
SHA512 09839461136016d3fea7c979b7cc3d19d3b5db6badd908ce151f9d1fee82dfd6aa0a1948d3ba1fb1c6ac10d3f92982a3e01bcf94646aafee5e233054904b24cf
SSDEEP 3072:Ser/xKtvPiYsL1RiK+WLUJoZ9w8Q1ObLDIZTGPBJ8Mxrx:+niR3ZJ9A1OHXj8M
TLSH
T1F8047B4AB3A910F9D1B7C138C9921606FB7278250370ABDF47A447769F236E49D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	hack.exe
5536	hack.exe

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	ShellHost.exe

C:\Users\Admin\AppData\Local\Temp\hack.exe
"C:\Users\Admin\AppData\Local\Temp\hack.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E0
1⤵
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:5952

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2500