Analysis
- max time kernel
148s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/03/2026, 03:35
Behavioral task
behavioral1
Sample
a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe
- Size 6.3MB
- Sample260305-d5ep2acz5v
- SHA256 a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef
- MD5 87a2953e26aaa7346d78d950ee2e8b74
- SHA1 7f6dd75ccbe45f0ed76238c47cc122cf3f1b2568
- SHA512 c77f358eac83e645fef9700c2d61c01d442a0a40be128325e8fd181fe814469512d4a88922cdeb67993c3536897fdf76e6d570fbfb7ee886aa0594607d9753dc
- SSDEEP 49152:KKRQ5zOAr5ltUmQCKqY8leS3WCguzUb3x5dd7k+K5mK2VyjnvVx4/9w5JxfKiK9j:KKojHpFgeUbv/jqvVxyipbDZE3
- TLSH T1F3664A03ECA555E5C0AEE23186679152BBB17C485B3123D32BA0F7392F72BD0AE79750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4284 WMIC.exe Token: SeSecurityPrivilege 4284 WMIC.exe Token: SeTakeOwnershipPrivilege 4284 WMIC.exe Token: SeLoadDriverPrivilege 4284 WMIC.exe Token: SeSystemProfilePrivilege 4284 WMIC.exe Token: SeSystemtimePrivilege 4284 WMIC.exe Token: SeProfSingleProcessPrivilege 4284 WMIC.exe Token: SeIncBasePriorityPrivilege 4284 WMIC.exe Token: SeCreatePagefilePrivilege 4284 WMIC.exe Token: SeBackupPrivilege 4284 WMIC.exe Token: SeRestorePrivilege 4284 WMIC.exe Token: SeShutdownPrivilege 4284 WMIC.exe Token: SeDebugPrivilege 4284 WMIC.exe Token: SeSystemEnvironmentPrivilege 4284 WMIC.exe Token: SeRemoteShutdownPrivilege 4284 WMIC.exe Token: SeUndockPrivilege 4284 WMIC.exe Token: SeManageVolumePrivilege 4284 WMIC.exe Token: 33 4284 WMIC.exe Token: 34 4284 WMIC.exe Token: 35 4284 WMIC.exe Token: 36 4284 WMIC.exe Token: SeIncreaseQuotaPrivilege 4284 WMIC.exe Token: SeSecurityPrivilege 4284 WMIC.exe Token: SeTakeOwnershipPrivilege 4284 WMIC.exe Token: SeLoadDriverPrivilege 4284 WMIC.exe Token: SeSystemProfilePrivilege 4284 WMIC.exe Token: SeSystemtimePrivilege 4284 WMIC.exe Token: SeProfSingleProcessPrivilege 4284 WMIC.exe Token: SeIncBasePriorityPrivilege 4284 WMIC.exe Token: SeCreatePagefilePrivilege 4284 WMIC.exe Token: SeBackupPrivilege 4284 WMIC.exe Token: SeRestorePrivilege 4284 WMIC.exe Token: SeShutdownPrivilege 4284 WMIC.exe Token: SeDebugPrivilege 4284 WMIC.exe Token: SeSystemEnvironmentPrivilege 4284 WMIC.exe Token: SeRemoteShutdownPrivilege 4284 WMIC.exe Token: SeUndockPrivilege 4284 WMIC.exe Token: SeManageVolumePrivilege 4284 WMIC.exe Token: 33 4284 WMIC.exe Token: 34 4284 WMIC.exe Token: 35 4284 WMIC.exe Token: 36 4284 WMIC.exe Token: SeIncreaseQuotaPrivilege 5132 WMIC.exe Token: SeSecurityPrivilege 5132 WMIC.exe Token: SeTakeOwnershipPrivilege 5132 WMIC.exe Token: SeLoadDriverPrivilege 5132 WMIC.exe Token: SeSystemProfilePrivilege 5132 WMIC.exe Token: SeSystemtimePrivilege 5132 WMIC.exe Token: SeProfSingleProcessPrivilege 5132 WMIC.exe Token: SeIncBasePriorityPrivilege 5132 WMIC.exe Token: SeCreatePagefilePrivilege 5132 WMIC.exe Token: SeBackupPrivilege 5132 WMIC.exe Token: SeRestorePrivilege 5132 WMIC.exe Token: SeShutdownPrivilege 5132 WMIC.exe Token: SeDebugPrivilege 5132 WMIC.exe Token: SeSystemEnvironmentPrivilege 5132 WMIC.exe Token: SeRemoteShutdownPrivilege 5132 WMIC.exe Token: SeUndockPrivilege 5132 WMIC.exe Token: SeManageVolumePrivilege 5132 WMIC.exe Token: 33 5132 WMIC.exe Token: 34 5132 WMIC.exe Token: 35 5132 WMIC.exe Token: 36 5132 WMIC.exe Token: SeIncreaseQuotaPrivilege 5132 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5064 wrote to memory of 5024 5064 a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe 79 PID 5024 wrote to memory of 4284 5024 CMD.exe 81 PID 5064 wrote to memory of 6012 5064 a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe 83 PID 6012 wrote to memory of 5132 6012 CMD.exe 85 PID 5064 wrote to memory of 6032 5064 a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe 86 PID 6032 wrote to memory of 4892 6032 CMD.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe"C:\Users\Admin\AppData\Local\Temp\a94c78bdae1230f9ab072f9eef290294c3d0931ecb8f374bc516421e9630e5ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\system32\CMD.exeCMD /C "WMIC BIOS GET SERIALNUMBER"2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\System32\Wbem\WMIC.exeWMIC BIOS GET SERIALNUMBER3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC DISKDRIVE GET SERIALNUMBER"2⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\System32\Wbem\WMIC.exeWMIC DISKDRIVE GET SERIALNUMBER3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5132
-
-
-
C:\Windows\system32\CMD.exeCMD /C "WMIC CPU GET ProcessorID"2⤵
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\System32\Wbem\WMIC.exeWMIC CPU GET ProcessorID3⤵PID:4892
-
-