55c7b5643f0b2b8b0edc8767e5c8700ad94523c43f9d41833a0e5772ccc0e608

Analysis

max time kernel
298s
max time network
233s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/05/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hjbk.exe
Size 8.2MB
Sample260528-3kw61set2y
SHA256 55c7b5643f0b2b8b0edc8767e5c8700ad94523c43f9d41833a0e5772ccc0e608
MD5 c85251b07a0fe84b234b3236f93b35a8
SHA1 1e94da425159bbc6fae949d0142329e7fa6895db
SHA512 ec9ad88574fa0e26167fb5156c6835fe6f7e7e44cc71da52ebf51a6754b3a12c978d3d1ce4614ee502cee584351fe886c2303448c808bcd9cf0501efd9487235
SSDEEP 49152:yeJa/614UdpaBKNYh9MQZfBkCsICYXvAh:y/5mNYh24fBkgj/c
TLSH
T127968C567CE008EAD0AA633289F762957BB1BC090F7263D72E9073382FB26E45D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	1680	hjbk.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	hjbk.exe

Executes dropped EXE 2 IoCs

pid	Process
4868	f4Tx6BJshOmycpYOBKQX7rM0.exe
4556	nCUQ4aX5FCP_idh1oBXG3TxE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.myip.com
20	api.myip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4Tx6BJshOmycpYOBKQX7rM0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nCUQ4aX5FCP_idh1oBXG3TxE.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4868	f4Tx6BJshOmycpYOBKQX7rM0.exe
4868	f4Tx6BJshOmycpYOBKQX7rM0.exe
4556	nCUQ4aX5FCP_idh1oBXG3TxE.exe
4556	nCUQ4aX5FCP_idh1oBXG3TxE.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4868	1680	hjbk.exe	91
PID 1680 wrote to memory of 4556	1680	hjbk.exe	92

C:\Users\Admin\AppData\Local\Temp\hjbk.exe
"C:\Users\Admin\AppData\Local\Temp\hjbk.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\Documents\Screenshot album\f4Tx6BJshOmycpYOBKQX7rM0.exe
  "C:\Users\Admin\Documents\Screenshot album\f4Tx6BJshOmycpYOBKQX7rM0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Users\Admin\Documents\Screenshot album\nCUQ4aX5FCP_idh1oBXG3TxE.exe
  "C:\Users\Admin\Documents\Screenshot album\nCUQ4aX5FCP_idh1oBXG3TxE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f4Tx6BJshOmycpYOBKQX7rM0.exe

Path C:\Users\Admin\Documents\Screenshot album\f4Tx6BJshOmycpYOBKQX7rM0.exe
Size 4.4MB
SHA256 ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e
MD5 99ad2ddf6e557a1c47845ec44fd461ca
SHA1 2abc1eb6da0a9d20b19b10ca1477e03b164032c3
SHA512 3d39d66303174f63c36d4320af57d3d0ae4076f5f335cfe2a98b61cf17a36f433d530d814cb1840972b14c5de04194ee754eb0d189b626bc9bd2ed3ad3ee0db3
SSDEEP 49152:mbLf6J44F4KSnasi4/LsmJK6HBzbsO4iSC:2z6JP5rsi4mLObr
TLSH
T1B9267C00FCD719B6E40623728AA762AB273999064F329797EA44777EFD772D50C32309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nCUQ4aX5FCP_idh1oBXG3TxE.exe

Path C:\Users\Admin\Documents\Screenshot album\nCUQ4aX5FCP_idh1oBXG3TxE.exe
Size 4.4MB
SHA256 8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce
MD5 d3493063d2f8d1f6d1c1d69893a67d71
SHA1 42c0c76b28357dc5a64cca1654f9c4f965379d4e
SHA512 4215de9e4ee6892c0486f495a833c32d11ebe52db0f57b97b248ad8acc6f326ba8181b23ba3d9a03075e12b4062e07ea18e97bd2d1ce1fdc33e47fbbbd69682b
SSDEEP 24576:ngFVlPGgCg/Lo9oWlbllm5rbD70RypFp0GG+B57WsKZKdk9a90NtDGqLb5WLCK3i:noVjWbleKkkZfySb5B4FgG8bsOoG/
TLSH
T1CB268C51FD8709B2E506233249E762AB6738AD054F329B9BEA44777EE9732C50C33346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-0-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1680-27-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4556-25-0x0000000021600000-0x00000000216E8000-memory.dmp

Download

memory/4556-26-0x0000000021600000-0x00000000216E8000-memory.dmp

Download

memory/4868-12-0x0000000021700000-0x00000000217DD000-memory.dmp

Download

memory/4868-13-0x0000000021700000-0x00000000217DD000-memory.dmp

Download