4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Size 5.0MB
Sample260506-vycersfs7w
SHA256 4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62
MD5 5afcb69ac9a55efe3c1c9c05632dfc17
SHA1 5a4999b035f4f87786d4207cb48905b9e1aa8907
SHA512 cdb82d4ee8970a3da551924d1c6f264f381cdd6b843a90b1ee0e2f2c85d7bd9951bfee6a10956a4ffbcd0bb79277e8dfc2f5d9e77198add48489bb3eb9d8a230
SSDEEP 98304:UJyDPruaLZ9wF7AF5vQW1cjg07/mdoOsBhOMJ9gfg:2aL/wF7ALpdo7J9Y
TLSH
T1B036BF11FA8080B2E5A3013982BAA77B897DBD301724C5C763E42D7A4E716D17B3E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\JhxI7e9g.sys	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
File created	C:\Windows\System32\drivers\ScOkWMLAV.sys	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\JhxI7e9g\ImagePath = "system32\\DRIVERS\\JhxI7e9g.sys"	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScOkWMLAV\ImagePath = "system32\\DRIVERS\\ScOkWMLAV.sys"	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Executes dropped EXE 2 IoCs

pid	Process
4552	1C1E.tmp
5264	1C3E.tmp

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeShutdownPrivilege	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeDebugPrivilege	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeDebugPrivilege	4552	1C1E.tmp
Token: SeDebugPrivilege	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeLoadDriverPrivilege	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeDebugPrivilege	5264	1C3E.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4552	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe	84
PID 4544 wrote to memory of 5264	4544	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe	85

C:\Users\Admin\AppData\Local\Temp\4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
"C:\Users\Admin\AppData\Local\Temp\4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\1C1E.tmp
  "C:\Users\Admin\AppData\Local\Temp\1C1E.tmp" 612
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\1C3E.tmp
  "C:\Users\Admin\AppData\Local\Temp\1C3E.tmp" 632
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C1E.tmp
Size 463KB
SHA256 6c5e14139c01e04463d52552f0df1825eec6e8d2a0e17ba22e7afc7f422e097f
MD5 e45bfd0dda871f2ed899b1b9f39a1727
SHA1 358ee512209152e9ccf12583b200429d5dfba2f8
SHA512 eb7949dbd27fb5b2bab95e16f39f9b83c7e6f30c900fbb9f71a4f8fe22719a6ffd6b1ef5d66eaf1979bce304d9f200a2233c2b1f1ebf2528fe76a4052b6067fb
SSDEEP 12288:zeq98eSx5cA1zXpDm649VCClXyctmS5V2NDZuFxk/:b9Fka8Xpe9VCClXyctmS5V2N9uFxk/
TLSH
T130A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4544-0-0x0000000000930000-0x0000000000E5D000-memory.dmp

Download

memory/4544-13-0x0000000002AB0000-0x0000000002B37000-memory.dmp

Download

memory/4552-5-0x000002CCEEF40000-0x000002CCEEFDB000-memory.dmp

Download

memory/5264-11-0x000001FFF39C0000-0x000001FFF3A5B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads