9eb046674e605fed5a99e6300c4a4e0bfc9470c4f31b2efebb57932b19e90886

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/03/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11.13.exe
Size 107KB
Sample260313-e27gbahs6z
SHA256 9eb046674e605fed5a99e6300c4a4e0bfc9470c4f31b2efebb57932b19e90886
MD5 1f711fd0600f268dffe5a19e8a4dcfba
SHA1 1b59a12c8c44d02dd998c4dbd1e0184865e80ec1
SHA512 f8889dae59c8bf469f290bf1443de8a3fbb66ee9c8aabff0e5bfd3ce5563ac7eb76518f7712555922cfd8cc08eb7de6bda4b46bf452d36cbfe87aa5ac73c887c
SSDEEP 3072:375GNDUaunHmshiTBiuJqJnuLLPWpfLTsIih+jhnKIsnT6ss:3o+ILPwDTBih+jUhW
TLSH
T147B31806A67D61F9D87A81788AA35B52F7313C194B3C538F8B6446651FA3BD0EF39320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3820 set thread context of 5116	3820	svchost.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchost.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
3772	timeout.exe
1096	timeout.exe
3836	timeout.exe
3920	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1200	11.13.exe
1200	11.13.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
5116	dllhost.exe
5116	dllhost.exe
5116	dllhost.exe
5116	dllhost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
5116	dllhost.exe
5116	dllhost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe
3820	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	11.13.exe
Token: SeDebugPrivilege	3820	svchost.exe
Token: SeDebugPrivilege	3820	svchost.exe
Token: SeDebugPrivilege	3820	svchost.exe
Token: SeDebugPrivilege	3820	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1156	1200	11.13.exe	18
PID 1200 wrote to memory of 1156	1200	11.13.exe	18
PID 1200 wrote to memory of 3552	1200	11.13.exe	79
PID 1200 wrote to memory of 4988	1200	11.13.exe	80
PID 1200 wrote to memory of 4620	1200	11.13.exe	81
PID 1200 wrote to memory of 232	1200	11.13.exe	85
PID 4988 wrote to memory of 1096	4988	cmd.exe	87
PID 4620 wrote to memory of 3772	4620	cmd.exe	88
PID 3552 wrote to memory of 3836	3552	cmd.exe	89
PID 232 wrote to memory of 3920	232	cmd.exe	90
PID 3820 wrote to memory of 5116	3820	svchost.exe	92
PID 3820 wrote to memory of 5116	3820	svchost.exe	92
PID 3820 wrote to memory of 5116	3820	svchost.exe	92

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5116

C:\Users\Admin\AppData\Local\Temp\11.13.exe
"C:\Users\Admin\AppData\Local\Temp\11.13.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\11.13.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\11.13.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\11.13.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\11.13.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-0-0x000001867EB50000-0x000001867EB51000-memory.dmp

Download

memory/1156-31-0x000001867EB50000-0x000001867EB51000-memory.dmp

Download

memory/1200-1-0x00000000023E0000-0x000000000248F000-memory.dmp

Download

memory/3820-2-0x0000000180000000-0x0000000180071000-memory.dmp

Download

memory/3820-6-0x00007FFB5A380000-0x00007FFB5A589000-memory.dmp

Download

memory/3820-32-0x0000021E38620000-0x0000021E386CF000-memory.dmp

Download

memory/5116-14-0x000001E81C290000-0x000001E81C291000-memory.dmp

Download

memory/5116-13-0x000001E81C2A0000-0x000001E81C2A1000-memory.dmp

Download

memory/5116-20-0x00007FFB5A380000-0x00007FFB5A589000-memory.dmp

Download