Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpaawvz4rd.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpaawvz4rd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpaawvz4rd.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target tmpaawvz4rd.exe
- Size 225KB
- Sample260602-a8acyabw2n
- SHA256 10ec07f61a80133fd64b84c6d5a1398c3983c8a8ed0fa6bb9037559c60239bdd
- MD5 8bed1ed75e41dce050e537587ab8fe40
- SHA1 fc5f2ebfdae550e728724b69bf9b27fd42be9095
- SHA512 236e06bbc0113fc98cda9401c71eb3c40d5d1efb9a8bf921c51dd34d562d66c60276d18d01c06f2b6eb6cf863ad80298d256b4c7332ab5d8ccf357cf94de9c97
- SSDEEP 6144:pA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:pATuTAnKGwUAW3ycQqgf
- TLSH T1C3346B31B7D0C435F5F213F449F652ABAA393DA16B34A0CB62D126EA5A346D8EC30357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 4152 4040 WerFault.exe 82 1164 3760 WerFault.exe 79 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpaawvz4rd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3220 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE Token: SeShutdownPrivilege 3220 Explorer.EXE Token: SeCreatePagefilePrivilege 3220 Explorer.EXE - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4040 winver.exe 3760 tmpaawvz4rd.exe 3220 Explorer.EXE 3220 Explorer.EXE 3220 Explorer.EXE - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3220 Explorer.EXE 3220 Explorer.EXE 3220 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3220 Explorer.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3760 wrote to memory of 4040 3760 tmpaawvz4rd.exe 82 PID 4040 wrote to memory of 3220 4040 winver.exe 54 PID 3760 wrote to memory of 3220 3760 tmpaawvz4rd.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\tmpaawvz4rd.exe"C:\Users\Admin\AppData\Local\Temp\tmpaawvz4rd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 3324⤵
- Program crash
PID:4152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 7563⤵
- Program crash
PID:1164
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4040 -ip 40401⤵PID:2208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3760 -ip 37601⤵PID:1264