80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
Size 485KB
Sample260427-ntabaacy6q
SHA256 80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df
MD5 6e1a00c7672eddce19f13ccabf36638f
SHA1 ddb0403e0955935c48fa9222f35e42dee43a4bfe
SHA512 7fff3439c7c4a7fe14531ebe5c2770934b26139fa682bdb987526808c908664f7031a3917706e5e020a0ca3d658ebba35cbdb2722ea2cceb7b2ddc4f089c75fb
SSDEEP 6144:kBksU2ZkpBcZ6AWxdAdBCVIDqf4T5E/NW7p3uaJNu3wyZVghPJjBV:kqgGBc8AZEyDqf4N0M7p0PiFrV
TLSH
T1CBB46C03BA9552B8D0AAC079930A9573A933B8850734BAFF03D459323F55FE62B3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5496 set thread context of 1408	5496	svchost.exe	84

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5380	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
Token: SeDebugPrivilege	900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
Token: SeDebugPrivilege	5496	svchost.exe
Token: SeDebugPrivilege	5496	svchost.exe
Token: SeDebugPrivilege	5496	svchost.exe
Token: SeDebugPrivilege	5496	svchost.exe
Token: SeDebugPrivilege	5496	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1268	900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe	21
PID 900 wrote to memory of 1288	900	80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe	80
PID 1288 wrote to memory of 5380	1288	cmd.exe	82
PID 5496 wrote to memory of 1408	5496	svchost.exe	84
PID 5496 wrote to memory of 1408	5496	svchost.exe	84
PID 5496 wrote to memory of 1408	5496	svchost.exe	84

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1268
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\dwm.exe
    C:\Windows\system32\dwm.exe
    3⤵
    PID:1408

C:\Users\Admin\AppData\Local\Temp\80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe
"C:\Users\Admin\AppData\Local\Temp\80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\80210f7ff05dd3fff7e263ad6f38973967f8d26fe2cdfa99adbd5da351f2e8df.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-0-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/1268-1-0x00000236175C0000-0x00000236175C1000-memory.dmp

Download

memory/1408-27-0x0000029AAE910000-0x0000029AAE911000-memory.dmp

Download

memory/1408-36-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/1408-32-0x0000000180000000-0x00000001800FA000-memory.dmp

Download

memory/5496-8-0x00007FFCE6FE4000-0x00007FFCE6FE5000-memory.dmp

Download

memory/5496-15-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/5496-10-0x0000018AAF9E0000-0x0000018AAF9E2000-memory.dmp

Download

memory/5496-26-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/5496-2-0x0000000180000000-0x0000000180050000-memory.dmp

Download

memory/5496-6-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/5496-16-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/5496-24-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download

memory/5496-11-0x0000018AB1400000-0x0000018AB14FA000-memory.dmp

Download

memory/5496-43-0x00007FFCE6F40000-0x00007FFCE7149000-memory.dmp

Download