b81f7857054abd316abbdbcbfcadbd36e2041334f1f6ba068a3bbd8c990ebfff

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sf实时物流s.exe
Size 468KB
Sample260511-j2wr2ads2w
SHA256 b81f7857054abd316abbdbcbfcadbd36e2041334f1f6ba068a3bbd8c990ebfff
MD5 3369aa3b6d53c920747fd5463b8aea40
SHA1 206935c9a4e3b69f7df639db76017cd0a59d49e7
SHA512 3af22161495650c6f5da44135ecbf5ca4de2e93e23908b2e34df078111518490df9007c87c0e69497d0ca5057b2d57330584a173ba149976b24b5f40ccdacc2c
SSDEEP 12288:FUZ2TPf0Zu1JaFAZOTNaLygPkD3uvgPMiuhQ5HLpf:FUZ2TPf0ZWLOTQLyLEDm
TLSH
T14EA46B0236F1C57AC2A756704EE6DB7CA6F5FD508D368A0B33C59B4D2D31A418B3A329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5052	JuLQArBsWS.exe

Loads dropped DLL 1 IoCs

pid	Process
5052	JuLQArBsWS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sf实时物流s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JuLQArBsWS.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\open\command	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\open	sf实时物流s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SFS~1.EXE \"%1\""	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\print\command	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\print	sf实时物流s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SFS~1.EXE /p \"%1\""	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\DefaultIcon	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\printto\command	sf实时物流s.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\printto	sf实时物流s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SFS~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	sf实时物流s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\ = "Turkme Document"	sf实时物流s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TurkmenNP.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SFS~1.EXE,1"	sf实时物流s.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	sf实时物流s.exe
1876	sf实时物流s.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1876	sf实时物流s.exe
1876	sf实时物流s.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 5052	1876	sf实时物流s.exe	80

C:\Users\Admin\AppData\Local\Temp\sf实时物流s.exe
"C:\Users\Admin\AppData\Local\Temp\sf实时物流s.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\JuLQArBsWS.exe
  "C:\Users\Admin\AppData\Local\Temp\JuLQArBsWS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JuLQArBsWS.exe

Path C:\Users\Admin\AppData\Local\Temp\JuLQArBsWS.exe
Size 662KB
SHA256 3acf30c6056d6cc834065f933160fe3c8ea7f5923ea850c2741c9bd5d595b4ef
MD5 e8d1f775cbc4eedc70d98efc152f8840
SHA1 7ea26faf3882407fe5c5c726abd4cef16be14d50
SHA512 f124b1912ccf2927c73d512e943396305771f6298a4d70d9f08770679a525482d48b7bc4c56731968a2a060927d8ca2ae7bd0a604d44a6ccf477ad272e8885e3
SSDEEP 12288:5xZmXKktPhTNfVH2BxIYGwuR1tIQvi2Z/2aLZhU/ool+oTylpyIM7hdyrXc3GRhg:30OdyrTRhUS9f1kcu6cdmeP
TLSH
T11FE4AF51768280B6D1B20130496CF7B6157EBE361F3649E7A3887F2D5E306F21E36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\zlib1.dll
Size 156KB
SHA256 1f6e03a9d0416cab8cad912d2e439ec5d3d7570f31f882a0ff608e7ce853ecc1
MD5 9002ea9b931d22fceca8cb7b89df8396
SHA1 93f2cc98722569f6401051329a8db91f027fff89
SHA512 01a1824480f5d01ff24272c7f91173f6839a68d76732bd734bc8ca253b39f87981ac245b1d42542002a0f6a9a7aca794772b8ca34e1658bb03ffced58d05989c
SSDEEP 3072:jIizHCB+mlAZWpn6PnBXzfbNt5IrJhtJJ7QPFGd88:jIBB4ZWpnYZbN3I1lJ7Cw8
TLSH
T1B1F3AF227160C07AD2AE553D0E61AB36E3FFE870CFB18A476B64C79D1D31A41DF26212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-17-0x0000000000A00000-0x0000000000A7B000-memory.dmp

Download

memory/5052-21-0x0000000000F30000-0x0000000000FAB000-memory.dmp

Download