Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpn8tg8kbw.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpn8tg8kbw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpn8tg8kbw.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target tmpn8tg8kbw.exe
- Size 54KB
- Sample260522-n2vbescw9z
- SHA256 352f268ad4b51736e9fbe580a6890a04ea378792944dfcd35f263848ba5c4d3d
- MD5 33e8d9d3b5ea9eec3706648412add917
- SHA1 c6fb4cb2236c584599b679bef8964d190a3c1544
- SHA512 409adbf4ffdb659a96e86e108455a2f1efb7652faf5a9507007eeca5e500bb9a97560284abc1f517b1573370beb776ae0a264228f4e1273dd5682e1bf1d9898c
- SSDEEP 768:VL3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBS:VD5tPusSRJDTlLTOpJiaDjts4gfFi2+A
- TLSH T16B430721F7AD4034F39A4AF919B1CB9C41B73E35AD64950B530BDCAF1E312E1A9A4B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4992 set thread context of 2824 4992 tmpn8tg8kbw.exe 80 - Program crash 1 IoCs
pid pid_target Process procid_target 5900 4392 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpn8tg8kbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpn8tg8kbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4392 winver.exe 4392 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3148 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4392 winver.exe 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE 3148 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4992 tmpn8tg8kbw.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4992 wrote to memory of 2824 4992 tmpn8tg8kbw.exe 80 PID 4992 wrote to memory of 2824 4992 tmpn8tg8kbw.exe 80 PID 4992 wrote to memory of 2824 4992 tmpn8tg8kbw.exe 80 PID 2824 wrote to memory of 4392 2824 tmpn8tg8kbw.exe 81 PID 4392 wrote to memory of 3148 4392 winver.exe 54 PID 4392 wrote to memory of 2224 4392 winver.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2224
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\tmpn8tg8kbw.exe"C:\Users\Admin\AppData\Local\Temp\tmpn8tg8kbw.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\tmpn8tg8kbw.exe"C:\Users\Admin\AppData\Local\Temp\tmpn8tg8kbw.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 4245⤵
- Program crash
PID:5900
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4392 -ip 43921⤵PID:5228