Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp4se36u39.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp4se36u39.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp4se36u39.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target tmp4se36u39.exe
- Size 54KB
- Sample260529-ldpd6ags2m
- SHA256 4110d372545ba5c3a8374c5e39cef5bea1b50dce46020c1983d45ef9f180f426
- MD5 7e556eb0df043e156ac5fd6703590e00
- SHA1 1261ddc52e4213a944c06aa1ebb7a16aeaeb128c
- SHA512 f5b95cf9088ef0c5eaf1bc96580d6c7763bcb902929de844b57fc00fbf2ce471c2cf6bbf2171584e3672798cf55ffa3d9bc62b5f0e2e3f1d619b852fa442af86
- SSDEEP 768:13CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBS:l5tPusSRJDTlLTOpJiaDjts4gfFi2+A
- TLSH T1C6430721F7AD4034F39A4AF919B1CB9C41B73E35AD60950B530BDCAF1E312E1A9A4B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1552 set thread context of 980 1552 tmp4se36u39.exe 80 - Program crash 1 IoCs
pid pid_target Process procid_target 3616 4568 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp4se36u39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp4se36u39.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4568 winver.exe 4568 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3176 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4568 winver.exe 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1552 tmp4se36u39.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1552 wrote to memory of 980 1552 tmp4se36u39.exe 80 PID 1552 wrote to memory of 980 1552 tmp4se36u39.exe 80 PID 1552 wrote to memory of 980 1552 tmp4se36u39.exe 80 PID 980 wrote to memory of 4568 980 tmp4se36u39.exe 81 PID 4568 wrote to memory of 3176 4568 winver.exe 54 PID 4568 wrote to memory of 2736 4568 winver.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2736
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\tmp4se36u39.exe"C:\Users\Admin\AppData\Local\Temp\tmp4se36u39.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\tmp4se36u39.exe"C:\Users\Admin\AppData\Local\Temp\tmp4se36u39.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 4325⤵
- Program crash
PID:3616
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 45681⤵PID:3960