Analysis
- max time kernel
149s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpudttqa8b.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpudttqa8b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpudttqa8b.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target tmpudttqa8b.exe
- Size 54KB
- Sample260602-a44e8abv6n
- SHA256 f41e0bebaac53635691f321b48de45e72976310ad78a59f9a8e3448af9a8af2c
- MD5 9810c295a3ce6090afb6eb6ef568de35
- SHA1 ada7d134d7c98a40952f7d118ea5d303fad9c9a3
- SHA512 091ecd5fb695f52f09a5c7ab3b8ef39213cb3f0447101a97e4f877a35cbc5ad54317cf943a73466f2ceaf810ff537321e22d8d662d11211ee55c69ea70ef9bb8
- SSDEEP 768:B3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBy:55tPusSRJDTlLTOpJiaDjts4gfFi2+A
- TLSH T11E430721F7AD4034F39A4AF919B1CB9C41B73E35AD609507530BDCAF1E312E1A9A4B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4156 set thread context of 1896 4156 tmpudttqa8b.exe 82 - Program crash 1 IoCs
pid pid_target Process procid_target 1148 2832 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpudttqa8b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpudttqa8b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2832 winver.exe 2832 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3232 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE Token: SeShutdownPrivilege 3232 Explorer.EXE Token: SeCreatePagefilePrivilege 3232 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2832 winver.exe 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE 3232 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4156 tmpudttqa8b.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4156 wrote to memory of 1896 4156 tmpudttqa8b.exe 82 PID 4156 wrote to memory of 1896 4156 tmpudttqa8b.exe 82 PID 4156 wrote to memory of 1896 4156 tmpudttqa8b.exe 82 PID 1896 wrote to memory of 2832 1896 tmpudttqa8b.exe 83 PID 2832 wrote to memory of 3232 2832 winver.exe 54 PID 2832 wrote to memory of 324 2832 winver.exe 51 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:324
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\tmpudttqa8b.exe"C:\Users\Admin\AppData\Local\Temp\tmpudttqa8b.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\tmpudttqa8b.exe"C:\Users\Admin\AppData\Local\Temp\tmpudttqa8b.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 4245⤵
- Program crash
PID:1148
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2832 -ip 28321⤵PID:5012