Analysis
- max time kernel
150s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 23:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp6fpzubc9.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp6fpzubc9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp6fpzubc9.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target tmp6fpzubc9.exe
- Size 54KB
- Sample260608-3f73qagv5w
- SHA256 2beeb922093016bc8341147408d61dc607d3a67f6afb2e62e048f853714fbaf0
- MD5 66086e9a673f687c67b032cea5c02690
- SHA1 7d89a5caeaae88c08582b14fe678e7ad92e68f86
- SHA512 065b97d456c8f0decbbf8cd46bbf95539921c8446cabfe00a764e2772c6bc781ed8be99beb1390f6e1985a5e215f8a59ee2bc931671c5d56bf859e024bb932f3
- SSDEEP 768:I3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBS:A5tPusSRJDTlLTOpJiaDjts4gfFi2+A
- TLSH T12E430721F7AD4034F39A4AF919B1CB9C41B73E35AD60950B530BDCAF1E312E1A9A4B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3260 set thread context of 976 3260 tmp6fpzubc9.exe 83 - Program crash 1 IoCs
pid pid_target Process procid_target 2040 1844 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6fpzubc9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6fpzubc9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1844 winver.exe 1844 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3212 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1844 winver.exe 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3260 tmp6fpzubc9.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3212 Explorer.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3260 wrote to memory of 976 3260 tmp6fpzubc9.exe 83 PID 3260 wrote to memory of 976 3260 tmp6fpzubc9.exe 83 PID 3260 wrote to memory of 976 3260 tmp6fpzubc9.exe 83 PID 976 wrote to memory of 1844 976 tmp6fpzubc9.exe 84 PID 1844 wrote to memory of 3212 1844 winver.exe 54 PID 1844 wrote to memory of 2444 1844 winver.exe 51 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2444
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\tmp6fpzubc9.exe"C:\Users\Admin\AppData\Local\Temp\tmp6fpzubc9.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\tmp6fpzubc9.exe"C:\Users\Admin\AppData\Local\Temp\tmp6fpzubc9.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 6245⤵
- Program crash
PID:2040
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1844 -ip 18441⤵PID:712