8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc.exe
Size 3.1MB
Sample260601-bcajhaax2x
SHA256 8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc
MD5 a0c2f5e90b9e91c6788b4f4a609aad56
SHA1 e7545f93967e75b3b265b8b04422d006ae77c356
SHA512 6a50f7e4fefa7f8b40063eeb3576071f7e094d67716dda5cfa7ad64d48d9c3a2b374a1544443edfec752bf17e7974218523eba283e4b9b864a7d318d311835b5
SSDEEP 98304:6Z5FJFiYigHx+LbxgW8nUE+ZN3bPLxMdXPqzbqWbe+Etq:6ZNHMnGtMz3XxMlPieWSBM
TLSH
T17DE533133FC6C8F1EB96AB701F65EB94AAE9F65007014EC797A10C0A5E056E5933E6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5068	7z.exe
4960	7z.exe
4120	7z.exe
4012	7z.exe
3980	7z.exe
5156	7z.exe
4344	ycorig.exe

Loads dropped DLL 6 IoCs

pid	Process
5068	7z.exe
4960	7z.exe
4120	7z.exe
4012	7z.exe
3980	7z.exe
5156	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeRestorePrivilege	5068	7z.exe
Token: 35	5068	7z.exe
Token: SeSecurityPrivilege	5068	7z.exe
Token: SeSecurityPrivilege	5068	7z.exe
Token: SeRestorePrivilege	4960	7z.exe
Token: 35	4960	7z.exe
Token: SeSecurityPrivilege	4960	7z.exe
Token: SeSecurityPrivilege	4960	7z.exe
Token: SeRestorePrivilege	4120	7z.exe
Token: 35	4120	7z.exe
Token: SeSecurityPrivilege	4120	7z.exe
Token: SeSecurityPrivilege	4120	7z.exe
Token: SeRestorePrivilege	4012	7z.exe
Token: 35	4012	7z.exe
Token: SeSecurityPrivilege	4012	7z.exe
Token: SeSecurityPrivilege	4012	7z.exe
Token: SeRestorePrivilege	3980	7z.exe
Token: 35	3980	7z.exe
Token: SeSecurityPrivilege	3980	7z.exe
Token: SeSecurityPrivilege	3980	7z.exe
Token: SeRestorePrivilege	5156	7z.exe
Token: 35	5156	7z.exe
Token: SeSecurityPrivilege	5156	7z.exe
Token: SeSecurityPrivilege	5156	7z.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4164	3616	_8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc.exe	80
PID 4164 wrote to memory of 5484	4164	cmd.exe	82
PID 4164 wrote to memory of 5068	4164	cmd.exe	83
PID 4164 wrote to memory of 4960	4164	cmd.exe	84
PID 4164 wrote to memory of 4120	4164	cmd.exe	85
PID 4164 wrote to memory of 4012	4164	cmd.exe	86
PID 4164 wrote to memory of 3980	4164	cmd.exe	87
PID 4164 wrote to memory of 5156	4164	cmd.exe	88
PID 4164 wrote to memory of 912	4164	cmd.exe	89
PID 4164 wrote to memory of 4344	4164	cmd.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\_8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc.exe
"C:\Users\Admin\AppData\Local\Temp\_8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:5484
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e file.zip -p66803205810896290683022218653 -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_5.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5156
- - C:\Windows\system32\attrib.exe
    attrib +H "ycorig.exe"
    3⤵
    - Views/modifies file attributes
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\main\ycorig.exe
    "ycorig.exe"
    3⤵
    - Executes dropped EXE
    PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
TLSH
T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 2.3MB
SHA256 eb2ad967079ab21382b374e46ff55e0e0aab413ec1867023216ced678314ad4c
MD5 2d85f25d5d658d719a178a2e46667d63
SHA1 99c908639aa419b73a5417096cdca540abe940f5
SHA512 191986e3721b08b0135a3a3f4e9885de587ad27d7eda7f0c89f7dc2ceed26be8d47be6f8ac6a76268f136845bdd74f18970f09be6a081408d4248cbf12d6fbc2
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/x0:R9kqGu7okoZscCnf0/Zs9j
TLSH
T1EBB501E4B7C8BCC68B9E93D7A1518EAE133301FB9993548C0586BBC91E1B785DF1C885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 458KB
SHA256 eae06ddb0e065f9bc34bd284ecd8c0f3e40097cfe819012eea4ea6de00733514
MD5 6d4fb855bbb3465b910de2a9dc28ed18
SHA1 12a1413fc78531f028e0dfa2e398a2f069a7ef85
SHA512 4e16782e0885869735a60ad0cac00e84d99206b101d9a89e68c632bb0dd3a3dc42092528226ec0ba012d8f1d36e06b167ddcb578938bf52c0a38b4ae78c16d56
SSDEEP 12288:PYKybUbqs5C5HvGoKDWwp7jdN4AnbQVLBAsQNTHGDpd8:PPywX5OeoKD/PbwdYGDT8
TLSH
T1B8A42332982F5D8B0D66C86B4E64D21C27D4FD3C40F62D49E1AA0A62B7F21578C72C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 458KB
SHA256 afd63084986d9484e93c6260150ff4132d262fc25c1d5dd54e16aa6dabb34d7e
MD5 41d87a6deb60a2699223c2f1d324d11d
SHA1 960c45afd19b0fb6f75aea54c35399f5ee56753f
SHA512 1362278cb421fb68735dd1c4ac89ed8342811c27c840dc2f3a3a771fc429a4f73a944dabd96a11f0213614111ab8df12afc738083cc48a5d8062d316fa47a6ad
SSDEEP 12288:iYKybUbqs5C5HvGoKDWwp7jdN4AnbQVLBAsQNTHGDpd6:iPywX5OeoKD/PbwdYGDT6
TLSH
T170A42332982F5D8B0D66887B4E64D21C27D8FD3C40F62D49E1AA0A62B7F61578C72C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
Size 458KB
SHA256 79a6704f88617ee40b59452f500133f299ce7f0f78c5d8e3bdc7a128aa6a2b2e
MD5 aa62dec00812c1a39a9d755079883b15
SHA1 7a57459c6a112f0c33b4775cc52b16ec2241b599
SHA512 5d2bbeed808d607e0eab908247ad5eff9835cb85ad2c4c8b64b009176489b62a2f8699d1ddb6b1293bd5a6aefda6675e12512255712c121b768632f10af32727
SSDEEP 12288:UYKybUbqs5C5HvGoKDWwp7jdN4AnbQVLBAsQNTHGDpdC:UPywX5OeoKD/PbwdYGDTC
TLSH
T132A42332982F5D8B4D6588BB4E60D21C27D8FD3C40F62D49E1AA0A62B7F61578C72C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
Size 458KB
SHA256 3616a116e5c1a54833b26382072c15c81bd52a801247193a2c9879579373507e
MD5 98fa52f0cb53c3ed407a5cb513658957
SHA1 409831659336b7391ad900a516210313e8736d9e
SHA512 74c1d41d288377d1b8d8d5df57503bd4d6b853d122bdc84c082f254e47b1757955291824faa0e75e47363e3d20d87d35704deffb4f5e54560b335257c931f530
SSDEEP 12288:f0kyFUFqwpClHzOoqb+wb7Z5H4yxbWVPX4sm5TJGDxhJ:fXyWbp4qoqbjDbov4GDzJ
TLSH
T121A42332982F5D8B1976846B4D70C21C27E8F83C50F63D59E1AA0A62B7F61578C72C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
Size 2.1MB
SHA256 582c6d2825d56c81ba06b6e191ebc237b6166e94e62060dfab64a7c6340816cf
MD5 794a290f4231a60891d036e0506ee83b
SHA1 078cbdea11c313d6b8dd4823310b2401e868e8de
SHA512 a52e179e7c4873140fe6715d9a98da2ba56c127fbad6acc516d00545e28ffd7f318c1f169c56396065924517a42fbdb0a05eba8ed4d0c0e59ae434784a5d748f
SSDEEP 49152:QujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oYWkq/HzG5:QaR3D0Ae5mwdkDWm1Xoo75
TLSH
T1DAA53314847F8FFBEC35A4390D66C21059B3B9B161AB2DF868C9390563B71AE5C4A43F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 2.1MB
SHA256 5c4311b5e0d08d15cfb05ce65181f2882859a93c96b64b914db6dde2c4d6ec1f
MD5 f810f60a0c9c394325da61a2333346df
SHA1 ed900427a1a6e3b37bdca41e539a47740c731084
SHA512 b69954c9dbf15b1b00001222ebe22ea650cda6bc0616f0a4f4f39b64ee236158035d0f054a32b5e2174c298756eacce3473222c0069d2557978a255609f8c670
SSDEEP 49152:W9ih6KtA6iR0CuBFrvWXyTmPGsaEgGn6hd0GH5J1Uy7MomoS:3hltA6zvWXghTG2JyRoS
TLSH
T1ECA533F1C9D3FD7A071BACF91D8C491FB5064BD69BC3444B7ABA059027D9F10A0B8A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 460B
SHA256 f938a5ac3ac8536669348fb2935c2b582fcd10eb11c356d6a5b2351964f10c13
MD5 5183312de787a0cbff7b3d03d0c637c6
SHA1 234812da7f9344b2b4b42ac57161dc0e5da3e4a7
SHA512 cbd569bde05d7272113bf9ba84ed2d06740bd849b2fcb3bb324222bbd8cfe891e5cf7afd8772edb9527c7f2afd2f2118d59256fe2bfe1d614284d78b4c5c90ea
TLSH
T14BF05C4126C6DCA24CC217C517AC3DC67967E85BC11FD9101B7040EE541C8ECE4CBFA6
MD5 SHA1 SHA512 TLSH

Submit Download

ycorig.exe

Path C:\Users\Admin\AppData\Local\Temp\main\ycorig.exe
Size 569KB
SHA256 dbcef1d924bb04367891dd29e75f2a1f3886600789f77b8207e211028db334ba
MD5 8198efbef12eb506d8e3b7b1d0f13c0f
SHA1 300e59931654ac17ccd1512a76c1d21fc8882b3f
SHA512 d6ef066786a573ad6d6563489e238db1c6012f6270c97cacbe2a3603e4417e61b64be7d66cd87bee6f5a2cfec46c6bb4f6d1aa8032fe8aa7142a40ebcedeeabd
SSDEEP 12288:MGIuaaaNUx8sQmktRkooKCWw4VvRHR4Afb4L11SLwDlb4zjW:MAaaae/PI+o2MZ7bekLwBbCjW
TLSH
T198C4F18233591F03C53A9BF408A5E0702BB6BD261A57D7CD6CD43CE7B9F8B444A21A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4344-55-0x000001373B000000-0x000001373B094000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads