Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpul9133da.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpul9133da.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpul9133da.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target tmpul9133da.exe
- Size 225KB
- Sample260525-2eb38abs2t
- SHA256 6d59d844329dba82ae8d3e7ff2d6d299d1f7751a2ff5e3a598698102b02a301d
- MD5 a9a3a5adbb8e9455108bbb186da043fd
- SHA1 779f0938ffa05c7d2277f55cf695349e27284934
- SHA512 0c4e0161f7a9f7ac48b76e5450bd332086ea8de3da559b4592eb9c3696bda94ee4debbde5f50686aec9c65fa2c929891d04b0a00667a416b55db40fdf49376f5
- SSDEEP 6144:EA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:EATuTAnKGwUAW3ycQqgX
- TLSH T190346B31B7D0C435F5F213F449F652ABAA393DA16B34A0CB62D126EA5A346D8EC30357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 668 3452 WerFault.exe 82 4272 5080 WerFault.exe 79 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpul9133da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5080 tmpul9133da.exe 5080 tmpul9133da.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3216 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3452 winver.exe 5080 tmpul9133da.exe 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE 3216 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3216 Explorer.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5080 wrote to memory of 3452 5080 tmpul9133da.exe 82 PID 3452 wrote to memory of 3216 3452 winver.exe 54 PID 5080 wrote to memory of 3216 5080 tmpul9133da.exe 54 PID 5080 wrote to memory of 2800 5080 tmpul9133da.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2800
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\tmpul9133da.exe"C:\Users\Admin\AppData\Local\Temp\tmpul9133da.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 3324⤵
- Program crash
PID:668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 9283⤵
- Program crash
PID:4272
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:4160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3452 -ip 34521⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5080 -ip 50801⤵PID:3332