bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 04:37

Target
bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df.exe
Size 38KB
Sample260706-e8ysradw2l
SHA256 bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df
MD5 f7f4251f8e10a45c1c6218e75e8d933d
SHA1 1a81486e165a545ba84b5539854cd698bce905bf
SHA512 94a28caa0884f9025a2887e61d9a6ccd2a8d36ef9c75ec58f391b713e5fb7dfe6943fbe4b7c777cec347d5937b36581ec1edadd2abb8aa3f1ef70b09fcd0671b
SSDEEP 768:0v1WwwvQiHPGTfW7Jv7iPX0K8dEBPIbPRW:uEvQiHPGr8iPX0KAvN
TLSH
T15D03CF03DFE98669D4268275C6770A1692A03A6407A35BCF5658E1C71F33388FA7F31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2496-0-0x00007FF67AFE0000-0x00007FF67AFF4000-memory.dmp	upx
behavioral2/memory/2496-7-0x00007FF67AFE0000-0x00007FF67AFF4000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df.exe
2496	bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 6464	2496	bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df.exe	89

C:\Users\Admin\AppData\Local\Temp\bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df.exe
"C:\Users\Admin\AppData\Local\Temp\bbc2928c182a754d4921d72a2cb3796b95ed3031142916e268e23220550fd3df.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_unins_res64.bat" "
  2⤵
  PID:6464

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

_unins_res64.bat

Path C:\Users\Admin\AppData\Local\Temp\_unins_res64.bat
Size 302B
SHA256 3cc518be0821a5ae4078d731ed2dba62a7af157321677f1ed30852942ad07d9d
MD5 4b176db74cc3cbce29e4b27671201fde
SHA1 3f273d1584e83167af8a5256be43047a77368c2d
SHA512 cf951c225b962ba25982a4c1850c24ef9a6b82edd6f718012c7722f97592777df19503c17279ed62d6c51aa098ad457dbad84f6640f2304d92e443335010b151
TLSH
T16EE0CD55C0D7B66F5C8A90DF0DB939CEC3938A9967923F21DA2046583194E49A651205
MD5 SHA1 SHA512 TLSH