a284a030ff5b736050700a9703c65afee3228b02d500ae70dba57e79f44fc77e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp8nkgxk34.exe
Size 225KB
Sample260522-psfx4sbs3p
SHA256 a284a030ff5b736050700a9703c65afee3228b02d500ae70dba57e79f44fc77e
MD5 35ba7b697773c931aa118e535af9ac0a
SHA1 267193abaaf22e04c8ecf59d983c54da75a1dd6c
SHA512 887e7f263af4f3e5acb1d1c1134ce2f3754cbfb07b3553589707a5b901ddfc99622e192a9093bafe33f01773768e15218aec2389e58b93a8a8b47667900fc548
SSDEEP 6144:nA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:nATuTAnKGwUAW3ycQqgf
TLSH
T1A4346B31B7D0C435F5F213F449F652ABAA393DA16B34A0CB62D126EA5A346D8EC30357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2388	460	WerFault.exe	91
1540	2172	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8nkgxk34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3408	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
460	winver.exe
2172	tmp8nkgxk34.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 460	2172	tmp8nkgxk34.exe	91
PID 460 wrote to memory of 3408	460	winver.exe	56
PID 2172 wrote to memory of 3408	2172	tmp8nkgxk34.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3408
- C:\Users\Admin\AppData\Local\Temp\tmp8nkgxk34.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8nkgxk34.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 312
      4⤵
      Program crash
      PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 676
    3⤵
    - Program crash
    PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 460 -ip 460
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2172 -ip 2172
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-1-0x0000000004A00000-0x0000000005058000-memory.dmp

Download

memory/2172-2-0x0000000003B30000-0x0000000003B31000-memory.dmp

Download

memory/2172-6-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2172-12-0x0000000004A00000-0x0000000005058000-memory.dmp

Download

memory/3408-4-0x0000000002BD0000-0x0000000002BD6000-memory.dmp

Download

memory/3408-5-0x0000000002BD0000-0x0000000002BD6000-memory.dmp

Download

memory/3408-9-0x0000000002C00000-0x0000000002C06000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads