Analysis
- max time kernel
149s - max time network
117s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 00:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpvz5pb2bz.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpvz5pb2bz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpvz5pb2bz.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target tmpvz5pb2bz.exe
- Size 54KB
- Sample260602-atkkcsbs9k
- SHA256 672548ff4ad14da8e0ffe43cd7323ee2a9b2e1c49db2b70b89d207a0d765cc08
- MD5 f5b6b173c7b1e3e08345135ce265ea80
- SHA1 3c529ecff890428411393b73f5db35b79ed1c992
- SHA512 c51efb69bd1376b514502e7cc9844667b02ddfff6cf42ce0af738f0c5301f25bc259307b7c579ae12e4b1979262d0663222eee131eae5dbe4a2cdeab8538d6d4
- SSDEEP 768:f3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBS:P5tPusSRJDTlLTOpJiaDjts4gfFi2+A
- TLSH T1D5430721F7AD4034F39A4AF919B1CB9C41B73E35AD60950B530BDCAF1E312E1A9A4B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4304 set thread context of 4208 4304 tmpvz5pb2bz.exe 81 - Program crash 1 IoCs
pid pid_target Process procid_target 1296 3904 WerFault.exe 82 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpvz5pb2bz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpvz5pb2bz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3904 winver.exe 3904 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3176 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3904 winver.exe 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4304 tmpvz5pb2bz.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3176 Explorer.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4304 wrote to memory of 4208 4304 tmpvz5pb2bz.exe 81 PID 4304 wrote to memory of 4208 4304 tmpvz5pb2bz.exe 81 PID 4304 wrote to memory of 4208 4304 tmpvz5pb2bz.exe 81 PID 4208 wrote to memory of 3904 4208 tmpvz5pb2bz.exe 82 PID 3904 wrote to memory of 3176 3904 winver.exe 54 PID 3904 wrote to memory of 2180 3904 winver.exe 51 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\tmpvz5pb2bz.exe"C:\Users\Admin\AppData\Local\Temp\tmpvz5pb2bz.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\tmpvz5pb2bz.exe"C:\Users\Admin\AppData\Local\Temp\tmpvz5pb2bz.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 4845⤵
- Program crash
PID:1296
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3904 -ip 39041⤵PID:5008