Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 00:35
Behavioral task
behavioral1
Sample
tmp7z4bx1op.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp7z4bx1op.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target tmp7z4bx1op.exe
- Size 45KB
- Sample260602-axe42sbt5k
- SHA256 1720c15a576fa6ded968fb798c12cfc9d1c93a0d723bbf420ee89f38f5577430
- MD5 84679050cb202d120a4abbeec6af4f2d
- SHA1 a47196b5fe6af8fc12694f413a298386c42ce1fe
- SHA512 d89c18197a6c50f98bfa76628b3644657c5c70e2986c05b3b7391e34815793a47ded5f104f216a0ff0909d4028fdd684281ed1242274429ac5d9b9e1ff29f15d
- SSDEEP 768:phP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2V:zsWE9N5dFu53dsniQaB/xZ14n7zIF+q5
- TLSH T17023F1DEEA177C6AF4B38E3D63030B354612AA3175AEE7571861D2DD2C31364CE41B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2860 bin.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\77994BC3 = "C:\\Users\\Admin\\AppData\\Roaming\\77994BC3\\bin.exe" winver.exe -
resource yara_rule behavioral3/memory/4604-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral3/files/0x001900000002b5ed-18.dat upx behavioral3/memory/2860-21-0x0000000000400000-0x000000000041D000-memory.dmp upx - Program crash 1 IoCs
pid pid_target Process procid_target 2336 4508 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp7z4bx1op.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bin.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4508 winver.exe 4508 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3196 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4508 winver.exe 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3196 Explorer.EXE - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4508 4604 tmp7z4bx1op.exe 81 PID 4508 wrote to memory of 3196 4508 winver.exe 54 PID 3196 wrote to memory of 2780 3196 Explorer.EXE PID 3196 wrote to memory of 2780 3196 Explorer.EXE PID 2780 wrote to memory of 2860 2780 Process not Found 83 PID 2780 wrote to memory of 2860 2780 Process not Found 83 PID 4508 wrote to memory of 2564 4508 winver.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2564
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\tmp7z4bx1op.exe"C:\Users\Admin\AppData\Local\Temp\tmp7z4bx1op.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 3804⤵
- Program crash
PID:2336
-
-
-
-
C:\Users\Admin\AppData\Roaming\77994BC3\bin.exeC:\Users\Admin\AppData\Roaming\77994BC3\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4508 -ip 45081⤵PID:2680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\77994BC3\bin.exe
- Size 45KB
- SHA256 ca53e588098f8c410917e931a9f980b011c791d18e0cc1e32dff7cc5a976e535
- MD5 8245a6a1b29cff7f8ba39d777d791b80
- SHA1 05f498d5359fa18e8d2192976d594ea4a2ef1005
- SHA512 228eb7bab38ad3bc15886e96f4ad6d8f765f32f128f25cfc9bfe89c4da16ce3b6d6180187a75c4d7366cb0a1a303e4609271848fee0fd1cb9c1e316003251687
- SSDEEP 768:ohP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2V:UsWE9N5dFu53dsniQaB/xZ14n7zIF+q5
- TLSH T16823F1DEEA177C6AF4B38E3D63030B354612AA3175AEE7571861D2DD2C31364CE41B2A
- MD5 SHA1 SHA512 SSDEEP TLSH