Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 01:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp6jzy1c0n.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp6jzy1c0n.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp6jzy1c0n.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target tmp6jzy1c0n.exe
- Size 88KB
- Sample260602-b1wfwaax71
- SHA256 08e54adadf284d5a1cd2119284d582e714a3c7da217fe2c82288c50b15ba702f
- MD5 cf15979f061c894cee007549b7c00e9a
- SHA1 aa279165a40651fd552c10f442a225dfdebefa21
- SHA512 b589685c376176186318f62f2f1dc8a4e79be81ae5179bc9339990830621ea88c828f487739df727e113db3d59e780ee233f7a33842e925a42c01f55ff5ccc61
- SSDEEP 1536:b5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:b5fvp12UFKcD/6jwqWsN
- TLSH T199932A71E205E48BD927D8F2991DCD3168923EBD99A0440E72E9BF6C58B37E21059F0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2860 bin.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\EAEED6E7 = "C:\\Users\\Admin\\AppData\\Roaming\\EAEED6E7\\bin.exe" winver.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2672 2440 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6jzy1c0n.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bin.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2440 winver.exe 2440 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3196 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2440 winver.exe 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE 3196 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3196 Explorer.EXE - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4740 wrote to memory of 2440 4740 tmp6jzy1c0n.exe 81 PID 2440 wrote to memory of 3196 2440 winver.exe 54 PID 3196 wrote to memory of 2724 3196 Explorer.EXE PID 3196 wrote to memory of 2724 3196 Explorer.EXE PID 2724 wrote to memory of 2860 2724 Process not Found 83 PID 2724 wrote to memory of 2860 2724 Process not Found 83 PID 2440 wrote to memory of 2564 2440 winver.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2564
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\tmp6jzy1c0n.exe"C:\Users\Admin\AppData\Local\Temp\tmp6jzy1c0n.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 3804⤵
- Program crash
PID:2672
-
-
-
-
C:\Users\Admin\AppData\Roaming\EAEED6E7\bin.exeC:\Users\Admin\AppData\Roaming\EAEED6E7\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2440 -ip 24401⤵PID:2960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\EAEED6E7\bin.exe
- Size 88KB
- SHA256 36a223c0ca7b819edfeea4c22d8b833d3791c8fa5a542cf3fed0cef04896476b
- MD5 c8d30db6c2df928d81d3ec04bf0b2a8f
- SHA1 e3074f04bae25728d6c0eaf515adc19e52c3068a
- SHA512 bd9fbf58af2bda8f1b11ea03a9d0236afbcac697498f24d3cc244390c1a2bfde84d2eb2a96c9793d3720176dec88b2d6eb67fc6ff4f447bb88a4092a34850993
- SSDEEP 1536:a5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:a5fvp12UFKcD/6jwqWsN
- TLSH T1F7932A71E205E48BD927D8F2991DCD3168923EBD99A0440E72E9BF6C58B37E21059F0F
- MD5 SHA1 SHA512 SSDEEP TLSH