0701cc7eb1af616294e90cbb35c99fa2b29d2aada9fcbdcdaf578b3fcf9b56c7

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/hhw.exe
Size 428KB
Sample260420-pldjeah14l
SHA256 0701cc7eb1af616294e90cbb35c99fa2b29d2aada9fcbdcdaf578b3fcf9b56c7
MD5 ef01cdd3801b0fc357fc2ab9abe0093a
SHA1 ca988ac80bc4f0d0cbf5496cae03971a91d055c7
SHA512 53c3f3a5aa0f8e2b1bcd334bf63017fb18dd294cb9033a524304c0fac0a39b423313e6d5ec4e63a2d4a6b3f5aebf6fa2d9143d0a1802094c6c7a214039acd930
SSDEEP 6144:3AV70bcVX0T8I1Kw1cZmv6BkjT28uPVfALD2RdLMdpTXyhNW3vC00:35bcJA8I1v1cu/28UVfALD2A7
TLSH
T15094082237F98526E5B77F311FB60B606A76BC91AD38C74F6B80561D8C35E40DA20B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hhw.exe

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	hhw.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Msg.Document	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msg.Document\ = "Msg Document"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Msg.Document\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\shell\open	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File\ = "Table of Contents"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Msg.Document\shell\open	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe,5"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Text.File\shell\open\command	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Text.File\shell\open	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTM.File	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Log.File\shell\open\command	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Log.File\shell\open	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File\shell\open\command	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Text.File\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File\shell\open	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhc.file\DefaultIcon	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe,3"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhk.file\DefaultIcon	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhp	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhp\ = "Hhp.File"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Log.File	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Text.File	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Log.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\DefaultIcon	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\shell\open\command	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Text.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhc.File\shell\open\command	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhc\ = "Hhc.File"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File\ = "Index"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Msg.Document\shell\open\command	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msg.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe,4"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Log.File\ = "Log File"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Text.File\ = "Text File"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTM.File\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhp.File\shell\open\command	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTM.File\shell\open\command	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTM.File\shell\open	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhc	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhk.File\shell\open	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhk\ = "Hhk.File"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hhp.File	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\ = "HHP File"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hhp.file\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HTM.File\ = "HTML File"	hhw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HTM.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\hhw.exe\" %1"	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Log.File\shell	hhw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhk	hhw.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3748	hhw.exe
Token: SeIncBasePriorityPrivilege	3748	hhw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3748	hhw.exe
3748	hhw.exe

C:\Users\Admin\AppData\Local\Temp\bin\hhw.exe
"C:\Users\Admin\AppData\Local\Temp\bin\hhw.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3748-0-0x000000005F8CA000-0x000000005F8CB000-memory.dmp

Download