Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
temp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
temp.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target temp.exe
- Size 73KB
- Sample260706-eadpxshv41
- SHA256 aa630f3db2ea4bb05d84499d83d724991be65c5418f1d7ce7a06e54619beef33
- MD5 17200eac1227c433789ae721055752cf
- SHA1 3ba937d8679754da0f54a71f9806287d8d7e87e3
- SHA512 795cf43b4c246572a8f4688049fad17c07b15a5f61b5d9abc8e872ceea81263db70db551894f059ac530a24eb2068f85c4dd2516f87566e75111c9aad11fb97b
- SSDEEP 768:/hNeOV+eONzUKN36aPADk3Gueziebzek3pUZ/EQv4qp4XotXwbrvG8p4FN9GQC8Z:iOqzbtYDwGNewcBwqp4686pp46
- TLSH T19973192E9C37506AC7A4CD7DC1261A41EB22BC8E4BD56BEB67C40CE50E269DC5F39903
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 948 WMIC.exe 948 WMIC.exe 948 WMIC.exe 948 WMIC.exe 3772 WMIC.exe 3772 WMIC.exe 3772 WMIC.exe 3772 WMIC.exe 1156 WMIC.exe 1156 WMIC.exe 1156 WMIC.exe 1156 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 948 WMIC.exe Token: SeSecurityPrivilege 948 WMIC.exe Token: SeTakeOwnershipPrivilege 948 WMIC.exe Token: SeLoadDriverPrivilege 948 WMIC.exe Token: SeSystemProfilePrivilege 948 WMIC.exe Token: SeSystemtimePrivilege 948 WMIC.exe Token: SeProfSingleProcessPrivilege 948 WMIC.exe Token: SeIncBasePriorityPrivilege 948 WMIC.exe Token: SeCreatePagefilePrivilege 948 WMIC.exe Token: SeBackupPrivilege 948 WMIC.exe Token: SeRestorePrivilege 948 WMIC.exe Token: SeShutdownPrivilege 948 WMIC.exe Token: SeDebugPrivilege 948 WMIC.exe Token: SeSystemEnvironmentPrivilege 948 WMIC.exe Token: SeRemoteShutdownPrivilege 948 WMIC.exe Token: SeUndockPrivilege 948 WMIC.exe Token: SeManageVolumePrivilege 948 WMIC.exe Token: 33 948 WMIC.exe Token: 34 948 WMIC.exe Token: 35 948 WMIC.exe Token: 36 948 WMIC.exe Token: SeIncreaseQuotaPrivilege 948 WMIC.exe Token: SeSecurityPrivilege 948 WMIC.exe Token: SeTakeOwnershipPrivilege 948 WMIC.exe Token: SeLoadDriverPrivilege 948 WMIC.exe Token: SeSystemProfilePrivilege 948 WMIC.exe Token: SeSystemtimePrivilege 948 WMIC.exe Token: SeProfSingleProcessPrivilege 948 WMIC.exe Token: SeIncBasePriorityPrivilege 948 WMIC.exe Token: SeCreatePagefilePrivilege 948 WMIC.exe Token: SeBackupPrivilege 948 WMIC.exe Token: SeRestorePrivilege 948 WMIC.exe Token: SeShutdownPrivilege 948 WMIC.exe Token: SeDebugPrivilege 948 WMIC.exe Token: SeSystemEnvironmentPrivilege 948 WMIC.exe Token: SeRemoteShutdownPrivilege 948 WMIC.exe Token: SeUndockPrivilege 948 WMIC.exe Token: SeManageVolumePrivilege 948 WMIC.exe Token: 33 948 WMIC.exe Token: 34 948 WMIC.exe Token: 35 948 WMIC.exe Token: 36 948 WMIC.exe Token: SeIncreaseQuotaPrivilege 3772 WMIC.exe Token: SeSecurityPrivilege 3772 WMIC.exe Token: SeTakeOwnershipPrivilege 3772 WMIC.exe Token: SeLoadDriverPrivilege 3772 WMIC.exe Token: SeSystemProfilePrivilege 3772 WMIC.exe Token: SeSystemtimePrivilege 3772 WMIC.exe Token: SeProfSingleProcessPrivilege 3772 WMIC.exe Token: SeIncBasePriorityPrivilege 3772 WMIC.exe Token: SeCreatePagefilePrivilege 3772 WMIC.exe Token: SeBackupPrivilege 3772 WMIC.exe Token: SeRestorePrivilege 3772 WMIC.exe Token: SeShutdownPrivilege 3772 WMIC.exe Token: SeDebugPrivilege 3772 WMIC.exe Token: SeSystemEnvironmentPrivilege 3772 WMIC.exe Token: SeRemoteShutdownPrivilege 3772 WMIC.exe Token: SeUndockPrivilege 3772 WMIC.exe Token: SeManageVolumePrivilege 3772 WMIC.exe Token: 33 3772 WMIC.exe Token: 34 3772 WMIC.exe Token: 35 3772 WMIC.exe Token: 36 3772 WMIC.exe Token: SeIncreaseQuotaPrivilege 3772 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 6948 wrote to memory of 3036 6948 temp.exe 91 PID 3036 wrote to memory of 948 3036 cmd.exe 92 PID 6948 wrote to memory of 4092 6948 temp.exe 94 PID 4092 wrote to memory of 3772 4092 cmd.exe 95 PID 6948 wrote to memory of 1064 6948 temp.exe 96 PID 1064 wrote to memory of 1156 1064 cmd.exe 97 PID 6948 wrote to memory of 3188 6948 temp.exe 98 PID 6948 wrote to memory of 6760 6948 temp.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6948 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber > C:\Windows\Temp\baseboard.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic logicaldisk get volumeserialnumber > C:\Windows\Temp\disk.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get volumeserialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_computersystemproduct get uuid > C:\Windows\Temp\uuid.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:6760
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Temp\baseboard.tmp
- Size 6B
- SHA256 2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
- MD5 bea07e6d2b8dce396fe21baa61b34956
- SHA1 665332b36fc8fa1ed11210cdee83b639b451e592
- SHA512 4ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\disk.tmp
- Size 178B
- SHA256 c624a6c35951ffe4fc4ae92bc863d3cf5a97f9e19455b757873a38b0e91f5ca1
- MD5 ba0216e80bb32787d28de2f3f664275a
- SHA1 1c3c886974efc5f21b70f92ddde6ad45a5727cb2
- SHA512 d3a70b71fb51f3f54778a924970543041d0acb0da6f291461b5e4201c786fa55deec40b4a593be2dae12d25b659304b788b1cb29fb7dbb8a3e01f761501691c1
- TLSH T1D9C0920649FC060461818048AC30802DA7D3711124BE014804CD600283D30002A033BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\uuid.tmp
- Size 162B
- SHA256 b323dcb8a0ab72cf53451e53ebab7548a922c51a132e7a73c14b3121aed9cba2
- MD5 d1e4d144596dc91c25d08e2ec4243a3d
- SHA1 6d1fb667658eb49dce2a3d84450e4721a5f0096a
- SHA512 0aa388d04b9985daec38a7d45306b01912b9cb4dc1f76db0db2fe6a7285984f533920f613be00f4fcc535dfe968ce54b39650f259f001472725a85167ac32589
- MD5 SHA1 SHA512