Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
osuPoint.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
osuPoint.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target osuPoint.exe
- Size 596KB
- Sample261102-ls36vsvs3l
- SHA256 077372036b57cff7664413bbc8ee3a8d0d0d93017a7e41d8650160d6d551235c
- MD5 6949407099bc36e4e4c5fc3b97424baa
- SHA1 f390cd84e21e8d43e5a54aea0340c97dff40f97f
- SHA512 862e6ba29edad8308c496645500db002e76a7c999fa17f57c495761d3e135b87341ab1999fd3535af8d2cbc1e08ffcfba9effabe91521ac1d8c94bfdd9731380
- SSDEEP 6144:xjBW914hMVroPBWs2BdBlV1nSGYGpATf5K2CRL1LAt/DYR9XiqgOak1UMWtXvEbr:dBW9GhmNlCOpaK2edA5NqAeUMWt6h3V
- TLSH T149D49E05B76413FDD567C2B8C9174A42EB72F84A03706BEB039089A62F276E45F7E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3284 osuPoint.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe 3284 osuPoint.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\config.ini
- Size 621B
- SHA256 13aa4b3cbb5e9bb8532b1a0a8818e941948525b998f50e17610ff8ca796b7c02
- MD5 2c80faa59c528b58b2185f22d9b423e2
- SHA1 ea91f66bca66bd819e8ca130b6fbdb799ad1340e
- SHA512 c20e0d7de045ae8b61688cf14d0850884eb5b82985caca412c0418974e910af696318973236c2d3d783810737e5702cc4240ac57e140bc5b57929d4b0ce7f0bd
- TLSH T1DCF049121322D67F44219BC370FF62D8E1F4E4D80A617648555AB4F23D4F4532A6E66C
- MD5 SHA1 SHA512 TLSH