aac1f7fc1a167c0e2986bb6b5180b1f3601582b7a8d3b7afdf8534c0120cccc8

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eden.exe
Size 59.0MB
Sample260517-acxtcses8q
SHA256 aac1f7fc1a167c0e2986bb6b5180b1f3601582b7a8d3b7afdf8534c0120cccc8
MD5 cb75cd200e5947b4e94c986c4d9cb5e3
SHA1 0146017f3a8081a7ab19c830b365dac1e6ca18f0
SHA512 8749d234606327cbccc7eb644cef3fe8f286cfc3af165705f62160eb5054fa2d64d2ab05deec46a173d4dd37b816e1e83b52394b523a3237c03c7cb81a148bf2
SSDEEP 393216:iZzWbo9tusHtdbBTJsQhVGyS4QUjtjaNIwTHFzK8KFdu9CwJsv6tME80/Gn:iZyWTLbBm2pS4uRzKlEs
TLSH
T1FAD77C43E29210E9D47FD231875BE332FA31B8895734BA9F1564DB212E31EA06B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	eden.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	eden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	eden.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	eden.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2220	eden.exe
2220	eden.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	eden.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	616	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	616	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	eden.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1960	2220	eden.exe	80

C:\Users\Admin\AppData\Local\Temp\eden.exe
"C:\Users\Admin\AppData\Local\Temp\eden.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\eden.exe
  C:\Users\Admin\AppData\Local\Temp\eden.exe
  2⤵
  PID:1960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000480 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads