Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 03:33
Behavioral task
behavioral1
Sample
fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe
- Size 8.8MB
- Sample261102-d4mn9ast6k
- SHA256 fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb
- MD5 64c941c47d5b03c099bd076b3fd37e27
- SHA1 7f6e638cfd3ec08d070eb4fd6e9e9db68585208f
- SHA512 3e9903efd519d76890ffaa8a1a80f6565bf98ca320c2a8e90710753f9a759015fdf5616bd4589816dcec60490f8e5268a25b2abcc061638ac4b2b03c4c454a5b
- SSDEEP 98304:W+cdPrO+27SVtv4EV+jbVYY8cJ7PCAoCF2t79YZqns:W3rNCSV6EV+jb7XoAmSYs
- TLSH T12096AE1A22AD11C4E1BBC17CCA875A67D7B27C1913709BCF019162AE1F27ED98E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe File opened for modification C:\Windows\system32\AppVClient.exe fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe File opened for modification C:\Windows\System32\GameInputSvc.exe fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4184 fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe"C:\Users\Admin\AppData\Local\Temp\fc97f1ec9214404f225ecda5a6c30bc36bd9eafc8b55ad2a697e47a5f50cdecb.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4184