162fb3f6b744df55265e7fea14bdb6c6358773ebf03d7fbc751f8c5b29f1c4aa

Analysis

user interaction
yes
max time kernel
28s
platform
windows11-21h2_x64
resource
win11-20260130-de
resource tags

arch:x64arch:x86image:win11-20260130-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
feet.exe
Size 1.4MB
Sample260511-v3wdfaa17p
SHA256 162fb3f6b744df55265e7fea14bdb6c6358773ebf03d7fbc751f8c5b29f1c4aa
MD5 4b956fd75cbb5691239698a238678480
SHA1 586fa557cec92ecf9a92482701dfd2b0e44f177e
SHA512 cb0bf42db0314c1f5367fa81751cd8c36cf8345529ce2c97e9ff6e9a34cfac2aac011617e81f4f60a4bb90e9c6a8286ff3425e54e0b3004a90fd89d28db2baef
SSDEEP 24576:DqvkTG+PuMNQX5UGS3iNpEnle5iAEXleEBcDvI5UGS3iNpEnSLuL+GQ:evkTvuqGaGSS3cMcAEXw7IaGSS3cLLm
TLSH
T114652398A6FA76B7D5F0483310E0F07BEA2D26154321C8D3E37C7E6942B6655DB3A1E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	feet.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
1892	timeout.exe
3188	timeout.exe
5480	timeout.exe
3048	timeout.exe
4800	timeout.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
1264	taskkill.exe
3628	taskkill.exe
1696	taskkill.exe
1120	taskkill.exe
4304	taskkill.exe
4264	taskkill.exe
4384	taskkill.exe
2380	taskkill.exe
4364	taskkill.exe
4416	taskkill.exe
3952	taskkill.exe
2416	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	3952	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 5016	4784	feet.exe	78
PID 5016 wrote to memory of 4268	5016	cmd.exe	80
PID 5016 wrote to memory of 4304	5016	cmd.exe	81
PID 5016 wrote to memory of 4264	5016	cmd.exe	83
PID 5016 wrote to memory of 2416	5016	cmd.exe	84
PID 5016 wrote to memory of 4384	5016	cmd.exe	85
PID 5016 wrote to memory of 2380	5016	cmd.exe	86
PID 5016 wrote to memory of 1264	5016	cmd.exe	88
PID 5016 wrote to memory of 1892	5016	cmd.exe	89
PID 5016 wrote to memory of 4488	5016	cmd.exe	90
PID 5016 wrote to memory of 3188	5016	cmd.exe	92
PID 5016 wrote to memory of 4364	5016	cmd.exe	93
PID 5016 wrote to memory of 4416	5016	cmd.exe	94
PID 5016 wrote to memory of 3628	5016	cmd.exe	95
PID 5016 wrote to memory of 1696	5016	cmd.exe	96
PID 5016 wrote to memory of 1120	5016	cmd.exe	97
PID 5016 wrote to memory of 3952	5016	cmd.exe	98
PID 5016 wrote to memory of 5480	5016	cmd.exe	99
PID 5016 wrote to memory of 3252	5016	cmd.exe	100
PID 3252 wrote to memory of 3048	3252	cmd.exe	102
PID 5016 wrote to memory of 4800	5016	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\feet.exe
"C:\Users\Admin\AppData\Local\Temp\feet.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6E45.tmp\6E46.tmp\6E47.bat C:\Users\Admin\AppData\Local\Temp\feet.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies registry class
    PID:4268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1892
- - C:\Windows\system32\cmd.exe
    cmd /c "echo Focus on me. Focus on feet. It's what you want, right?
    3⤵
    PID:4488
- - C:\Windows\system32\timeout.exe
    timeout /5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5480
- - C:\Windows\system32\cmd.exe
    cmd /c "echo Lick your screen~ &timeout /t 5 /nobreak>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3048
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6E47.bat

Path C:\Users\Admin\AppData\Local\Temp\6E45.tmp\6E46.tmp\6E47.bat
Size 773B
SHA256 3cbae0b4974515c135f0669d3b9d4bd58d5333fd20f2ba6d5a031ea01d9057b1
MD5 a91bbce5cd36665a9ef760f7aeedaf02
SHA1 62bdf72314f610be7edf67d9c376cf2b024e6bdf
SHA512 ebba60b27e2df16f2f32ede1889e78c07ad2c038c4e2eddbcf005dc198350a72cf34d4278038d1b79b7a36d07a1fb518ae9a9d5958c73112cf96ae02a3bab1b1
TLSH
T1DB01280F381BA50189DD09E199B93283FA86D167CC2495D2A862B138B30B585D7EA7CF
MD5 SHA1 SHA512 TLSH

Submit Download

feet0.jpg

Path C:\Users\Admin\AppData\Local\Temp\feet0.jpg
Size 230KB
SHA256 b79bcf963dede91b0c753ecb950997aa464369d49301bb79b8558ce5bc5210e3
MD5 4bd88322c7989f96053a4bebc9a5fa59
SHA1 4b0d3bc0f3a502e19fc89e439e211f50246a7f72
SHA512 59672952cd1086478266e121630d955af5d4cbe9f12637172f17f325c789a0f5655d3389c129db259473c87703eb9e36ee5db6337ab786ad04e1ab236de66d48
SSDEEP 6144:z5eKbBufTQRZAZLLW1twsZi+9wo9AxXHkS36jrzRn:zKfTSKLLWL9wXEY+zJ
TLSH
T1FB340276FBC7F36A4B13519E857D3EB363462AE099D205432913BD4AE268F71128327C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-32-0x000002D961BF0000-0x000002D961C5F000-memory.dmp

Download

memory/1264-24-0x000001B94D810000-0x000001B94D87F000-memory.dmp

Download

memory/1696-31-0x00000218F4B90000-0x00000218F4BFF000-memory.dmp

Download

memory/1892-26-0x000002DE1EF60000-0x000002DE1EFCF000-memory.dmp

Download

memory/2380-23-0x0000023545DC0000-0x0000023545E2F000-memory.dmp

Download

memory/2416-21-0x0000018AAE810000-0x0000018AAE87F000-memory.dmp

Download

memory/3048-36-0x000001D1E2720000-0x000001D1E278F000-memory.dmp

Download

memory/3188-27-0x0000018E2CD00000-0x0000018E2CD6F000-memory.dmp

Download

memory/3628-30-0x000001F88C3E0000-0x000001F88C44F000-memory.dmp

Download

memory/3952-33-0x0000023558D50000-0x0000023558DBF000-memory.dmp

Download

memory/4264-20-0x00000239F6720000-0x00000239F678F000-memory.dmp

Download

memory/4304-19-0x000002B2B9D50000-0x000002B2B9DBF000-memory.dmp

Download

memory/4364-28-0x0000012CE28F0000-0x0000012CE295F000-memory.dmp

Download

memory/4384-22-0x0000022AE5910000-0x0000022AE597F000-memory.dmp

Download

memory/4416-29-0x000001F607630000-0x000001F60769F000-memory.dmp

Download

memory/4784-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/4784-25-0x0000000000B70000-0x0000000000CBD000-memory.dmp

Download

memory/4800-37-0x000001B8F11C0000-0x000001B8F122F000-memory.dmp

Download

memory/5480-34-0x000001DF94640000-0x000001DF946AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads