Overview
overview
8Static
static
7Win11DeathEdition.exe
windows11-21h2-x64
8Windows 11...er.exe
windows11-21h2-x64
7Windows 11...lp.chm
windows11-21h2-x64
1Windows 11...on.cmd
windows11-21h2-x64
1Windows 11...gm.exe
windows11-21h2-x64
3Windows 11...pe.vbs
windows11-21h2-x64
3Windows 11...br.exe
windows11-21h2-x64
6Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/09/2024, 01:16
Behavioral task
behavioral1
Sample
Win11DeathEdition.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Windows 11 Death Edition Source Code/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Windows 11 Death Edition Source Code/Bat To Exe Converter/help.chm
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Windows 11 Death Edition Source Code/Win11DeathEdition.cmd
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Windows 11 Death Edition Source Code/bgm.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Windows 11 Death Edition Source Code/escape.vbs
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Windows 11 Death Edition Source Code/mbr.exe
Resource
win11-20240802-en
General
-
Target
Windows 11 Death Edition Source Code/bgm.exe
-
Size
102KB
-
MD5
dbc7a3b514ea61b80abddd1b0ce0f7b0
-
SHA1
fc30e8ca86ccca6437892b81b2027eaaef4b0123
-
SHA256
0655d878f1ad0cf365abaa2c41eb5ab84215265ba22300eb4e4603605280c040
-
SHA512
12ed40c58cde189eb7554c4dccc0558f9302a98f60274f1ddaee5f86bff89e4af2849724b40322ace269160d1c00cc9b508e32ed28c2b484412e4493289bfbbf
-
SSDEEP
768:J7FcybtwpM91ivG4al7fCwjfecgExpYc467yyxqOyWOjonu3yUyJCbfw287RDmay:v5iToUcHYGykqODu3yUyJCbfw287h1sF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bgm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3148 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3148 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\bgm.exe"C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\bgm.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4480
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3148