7dafe09a44e72c7b6522319e40c3fadcbad7a0b42d584988a1be8de818689896

Resubmissions

11/11/2026, 07:34

261111-jelcsaff2310

10/11/2026, 14:01

261110-rbw9wayt9j10

Analysis

user interaction
yes
max time kernel
122s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Win32.Stuxnet.B.Duqu-Realtek.zip
Size 55KB
Sample261111-jelcsaff23
SHA256 7dafe09a44e72c7b6522319e40c3fadcbad7a0b42d584988a1be8de818689896
MD5 c5d82342430cfd542bc287b178025e5f
SHA1 d7dddcc72f69cb9b11e7034a32d5308b27b09add
SHA512 2af2bd38593be1d3f5e6043e2c1da506105ba9a2bfd18d6cee796008860963d2bf74bf9548455e5869a1ba65ef28b8c96d60f0f74ebc9327554b50c7fd5916c7
SSDEEP 1536:eA+MutyypmyTYK7xtqUSi9QBqRJNsGrTEfmaJ:1+Mj+YixtqUSiDRJNsGvGmaJ
TLSH
T155430148FD076ADAE37E24B03E5109D4A3F012A674EDA619E0907BDD768E0025F369FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1652	63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.exe
3876	0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.exe
896	1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2964	7zG.exe
Token: 35	2964	7zG.exe
Token: SeSecurityPrivilege	2964	7zG.exe
Token: SeSecurityPrivilege	2964	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Win32.Stuxnet.B.Duqu-Realtek.zip
1⤵
PID:5108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4956

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap25309:114:7zEvent22393
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2964

C:\Users\Admin\Desktop\signed drivers\63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.exe
"C:\Users\Admin\Desktop\signed drivers\63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.exe"
1⤵
- Executes dropped EXE
PID:1652

C:\Users\Admin\Desktop\signed drivers\0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.exe
"C:\Users\Admin\Desktop\signed drivers\0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.exe"
1⤵
- Executes dropped EXE
PID:3876

C:\Users\Admin\Desktop\signed drivers\1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.exe
"C:\Users\Admin\Desktop\signed drivers\1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.exe"
1⤵
- Executes dropped EXE
PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.exe

Path C:\Users\Admin\Desktop\signed drivers\0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.exe
Size 16KB
SHA256 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198
MD5 cc1db5360109de3b857654297d262ca1
SHA1 758240613c362bb1fd13e07d3d19f357b7f8a6da
SHA512 63492d7be766606e3102f6444d94676a068378d7cf85d5bec27062f5fb9cc99bc8a34ee32d173b5a392d4773464327296985a0a7fc1fe27cdd8e060278f4ec28
SSDEEP 384:MYJsx/EzZYCb6NdEVAFba2iWs7pyWy0YJLWd6jqdybm:MYSx/ElbAdbY7p+ZLAmIybm
TLSH
T17D72F69637911034ECD72BB0889EF623B739F2821FA156C7216946CE6C427E17F3964E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.exe

Path C:\Users\Admin\Desktop\signed drivers\1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.exe
Size 25KB
SHA256 1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c
MD5 f8153747bae8b4ae48837ee17172151e
SHA1 cb0793029c60c0bd059ff85de956619f7fdeb4fd
SHA512 91c9e7e94f5fd82d8dfd0ebae7bcad3c9726fa4061a7650bc543341a64ab946783b915346ff77e1210d88e0de1e40f1285f385c0964a0651160ab35763d064b6
SSDEEP 384:GjBfuuPC3LNGL9BLKkVcr7mj3eSW0lhqaWd7pxW3KzMdYJLWd6jqdybI:mfuj3oLukV0mTeSJhm7p+KxLAmIybI
TLSH
T16AC26E837B902965EC950F3089EEEB62EDB6F1602A91C55703640D8E2F56BF06735B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.exe

Path C:\Users\Admin\Desktop\signed drivers\63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.exe
Size 24KB
SHA256 63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802
MD5 1e17d81979271cfa44d471430fe123a5
SHA1 e22b0d0b6d71c50bcd83e5da0b227371b142a386
SHA512 12374ba4080b7b287010338a31e3d686df7f631ec62073ee9b64ed8a349ca0087a32c3287d713952cc41c276ce64b9d029e52685e74027b1e5abd1efb2e38e33
SSDEEP 384:KMOM1RJyWzUIl+FQazFlXlHLguhg0TzQ3Tv22lu/IlIT5th851M6jWfbCC:KMv1RFUIiQExg0nQ3y2k/BnhUMmQbCC
TLSH
T1B3B28ED359C254F7DC9A1AB0C9AA8751E87AF4312D6FCE574B54488E1F227C0FB2424B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-13-0x0000000000010000-0x0000000000014D80-memory.dmp

Download

memory/1652-9-0x0000000000010000-0x0000000000015200-memory.dmp

Download

memory/3876-11-0x0000000000010000-0x0000000000012980-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads