Analysis
- max time kernel
150s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
03/09/2025, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20250619-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 1.1MB
- Sample250903-e51g6sv1ft
- SHA256 f856336662f462c18822a3595d3efee05d4a03eddc8ba13aadc2d83cad656a53
- MD5 a2908dec735dfc9a4ae89427218ec43c
- SHA1 0e422eba6195fc92459742bd7386270077f60585
- SHA512 9a51f56c0096f7a38ae73fdbe2e5e9ffba99b40014c1829856814ef9151a8c79d4192c36596e0b308afd0ab71cc4daac43395b013d54c220ef2cd19d5327f117
- SSDEEP 24576:qUYxEL+Rbj/0c9qx6rFdmJYPD7yasQIOzNx:qUAE69t9qsFpJUI
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4320 System.exe 3596 System.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3972667009-3658015838-2693993929-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\69E880B327CF3810289448\\System.exe" file.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3828 set thread context of 3700 3828 file.exe 78 PID 4320 set thread context of 3596 4320 System.exe 82 - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3700 file.exe 3700 file.exe 3596 System.exe 3596 System.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3304 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3700 file.exe Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeDebugPrivilege 3596 System.exe Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE Token: SeShutdownPrivilege 3304 Explorer.EXE Token: SeCreatePagefilePrivilege 3304 Explorer.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3828 wrote to memory of 3700 3828 file.exe 78 PID 3700 wrote to memory of 3304 3700 file.exe 52 PID 4872 wrote to memory of 4320 4872 cmd.exe 81 PID 4872 wrote to memory of 4320 4872 cmd.exe 81 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 4320 wrote to memory of 3596 4320 System.exe 82 PID 3596 wrote to memory of 3304 3596 System.exe 52
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\69E880B327CF3810289448\System.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Roaming\69E880B327CF3810289448\System.exeC:\Users\Admin\AppData\Roaming\69E880B327CF3810289448\System.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Roaming\69E880B327CF3810289448\System.exe"C:\Users\Admin\AppData\Roaming\69E880B327CF3810289448\System.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\69E880B327CF3810289448\System.exe
- Size 1.1MB
- SHA256 f856336662f462c18822a3595d3efee05d4a03eddc8ba13aadc2d83cad656a53
- MD5 a2908dec735dfc9a4ae89427218ec43c
- SHA1 0e422eba6195fc92459742bd7386270077f60585
- SHA512 9a51f56c0096f7a38ae73fdbe2e5e9ffba99b40014c1829856814ef9151a8c79d4192c36596e0b308afd0ab71cc4daac43395b013d54c220ef2cd19d5327f117
- SSDEEP 24576:qUYxEL+Rbj/0c9qx6rFdmJYPD7yasQIOzNx:qUAE69t9qsFpJUI
- MD5 SHA1 SHA512 SSDEEP