7cab83ec29c4234e01773d55e1e939a1c96eea960edd9c2840b8425d370de426

Analysis

user interaction
yes
max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server.exe
Size 34KB
Sample260628-naq5pagy6m
SHA256 7cab83ec29c4234e01773d55e1e939a1c96eea960edd9c2840b8425d370de426
MD5 d438b69a36bef97013ee2e2a58f96342
SHA1 99b2f4be442f5816a6aaf7bdad78dc604d41149a
SHA512 2a380189ef0251d05de5b912a5b6c7da800e3450ddc1b748e99ae9a2f39b0192e656989be17060c82d0982efefb1d243565077cc979ae1bef4314721ca472a00
SSDEEP 768:T7WXtbVrCBN29+eiYc3OZ6CV2ZVO8GEDcinf:T7WXtb1Cv+YYc3c65ZVOpUnf
TLSH
T1E5F2D062BFE59C69F0D5DB76087B911366A0FCEC91B49B2E00CAB135CEB02614B511BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery upx

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Server.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	Server.exe
File opened for modification	F:\autorun.inf	Server.exe
File created	C:\autorun.inf	Server.exe
File created	F:\autorun.inf	Server.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1904-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1904-22-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1904-226-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe
1904	Server.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	Server.exe
Token: SeDebugPrivilege	1904	Server.exe
Token: SeSystemtimePrivilege	1904	Server.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1904	Server.exe
1904	Server.exe
1904	Server.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2740	1904	Server.exe	89
PID 2740 wrote to memory of 5476	2740	net.exe	91

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Disables RegEdit via registry modification
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" user Admin Arashjeyjey
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user Admin Arashjeyjey
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.inf

Path C:\autorun.inf
Size 80B
SHA256 c50cbf7fd39b4a10679789e22b1b38f3daa9502b0ec37dc81c18f733b28cc3a4
MD5 75cd2fe1a6844ace91c89d1039edee07
SHA1 5944592b1496a2a7ec924c63ff84769d8e55edaa
SHA512 b63e023cefae407904f8fd368d9ddb8148546958cde13a99b10101541b59dda9fe1e2739f650c5c6168038e6fd1e154aa34608ff1cca020764df2974bf0ceda6
TLSH
T1CBA0120072B117061300D3C02C788830421BBC5F4061CB1D1550850901611000102DF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1904-22-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1904-226-0x0000000000400000-0x000000000041F000-memory.dmp

Download