Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
temp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
temp.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target temp.exe
- Size 73KB
- Sample260708-v6wtdaey3v
- SHA256 aa630f3db2ea4bb05d84499d83d724991be65c5418f1d7ce7a06e54619beef33
- MD5 17200eac1227c433789ae721055752cf
- SHA1 3ba937d8679754da0f54a71f9806287d8d7e87e3
- SHA512 795cf43b4c246572a8f4688049fad17c07b15a5f61b5d9abc8e872ceea81263db70db551894f059ac530a24eb2068f85c4dd2516f87566e75111c9aad11fb97b
- SSDEEP 768:/hNeOV+eONzUKN36aPADk3Gueziebzek3pUZ/EQv4qp4XotXwbrvG8p4FN9GQC8Z:iOqzbtYDwGNewcBwqp4686pp46
- TLSH T19973192E9C37506AC7A4CD7DC1261A41EB22BC8E4BD56BEB67C40CE50E269DC5F39903
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5060 WMIC.exe 5060 WMIC.exe 5060 WMIC.exe 5060 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 1776 WMIC.exe 3864 WMIC.exe 3864 WMIC.exe 3864 WMIC.exe 3864 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5060 WMIC.exe Token: SeSecurityPrivilege 5060 WMIC.exe Token: SeTakeOwnershipPrivilege 5060 WMIC.exe Token: SeLoadDriverPrivilege 5060 WMIC.exe Token: SeSystemProfilePrivilege 5060 WMIC.exe Token: SeSystemtimePrivilege 5060 WMIC.exe Token: SeProfSingleProcessPrivilege 5060 WMIC.exe Token: SeIncBasePriorityPrivilege 5060 WMIC.exe Token: SeCreatePagefilePrivilege 5060 WMIC.exe Token: SeBackupPrivilege 5060 WMIC.exe Token: SeRestorePrivilege 5060 WMIC.exe Token: SeShutdownPrivilege 5060 WMIC.exe Token: SeDebugPrivilege 5060 WMIC.exe Token: SeSystemEnvironmentPrivilege 5060 WMIC.exe Token: SeRemoteShutdownPrivilege 5060 WMIC.exe Token: SeUndockPrivilege 5060 WMIC.exe Token: SeManageVolumePrivilege 5060 WMIC.exe Token: 33 5060 WMIC.exe Token: 34 5060 WMIC.exe Token: 35 5060 WMIC.exe Token: 36 5060 WMIC.exe Token: SeIncreaseQuotaPrivilege 5060 WMIC.exe Token: SeSecurityPrivilege 5060 WMIC.exe Token: SeTakeOwnershipPrivilege 5060 WMIC.exe Token: SeLoadDriverPrivilege 5060 WMIC.exe Token: SeSystemProfilePrivilege 5060 WMIC.exe Token: SeSystemtimePrivilege 5060 WMIC.exe Token: SeProfSingleProcessPrivilege 5060 WMIC.exe Token: SeIncBasePriorityPrivilege 5060 WMIC.exe Token: SeCreatePagefilePrivilege 5060 WMIC.exe Token: SeBackupPrivilege 5060 WMIC.exe Token: SeRestorePrivilege 5060 WMIC.exe Token: SeShutdownPrivilege 5060 WMIC.exe Token: SeDebugPrivilege 5060 WMIC.exe Token: SeSystemEnvironmentPrivilege 5060 WMIC.exe Token: SeRemoteShutdownPrivilege 5060 WMIC.exe Token: SeUndockPrivilege 5060 WMIC.exe Token: SeManageVolumePrivilege 5060 WMIC.exe Token: 33 5060 WMIC.exe Token: 34 5060 WMIC.exe Token: 35 5060 WMIC.exe Token: 36 5060 WMIC.exe Token: SeIncreaseQuotaPrivilege 1776 WMIC.exe Token: SeSecurityPrivilege 1776 WMIC.exe Token: SeTakeOwnershipPrivilege 1776 WMIC.exe Token: SeLoadDriverPrivilege 1776 WMIC.exe Token: SeSystemProfilePrivilege 1776 WMIC.exe Token: SeSystemtimePrivilege 1776 WMIC.exe Token: SeProfSingleProcessPrivilege 1776 WMIC.exe Token: SeIncBasePriorityPrivilege 1776 WMIC.exe Token: SeCreatePagefilePrivilege 1776 WMIC.exe Token: SeBackupPrivilege 1776 WMIC.exe Token: SeRestorePrivilege 1776 WMIC.exe Token: SeShutdownPrivilege 1776 WMIC.exe Token: SeDebugPrivilege 1776 WMIC.exe Token: SeSystemEnvironmentPrivilege 1776 WMIC.exe Token: SeRemoteShutdownPrivilege 1776 WMIC.exe Token: SeUndockPrivilege 1776 WMIC.exe Token: SeManageVolumePrivilege 1776 WMIC.exe Token: 33 1776 WMIC.exe Token: 34 1776 WMIC.exe Token: 35 1776 WMIC.exe Token: 36 1776 WMIC.exe Token: SeIncreaseQuotaPrivilege 1776 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1564 wrote to memory of 4768 1564 temp.exe 89 PID 4768 wrote to memory of 5060 4768 cmd.exe 90 PID 1564 wrote to memory of 1412 1564 temp.exe 92 PID 1412 wrote to memory of 1776 1412 cmd.exe 93 PID 1564 wrote to memory of 2288 1564 temp.exe 94 PID 2288 wrote to memory of 3864 2288 cmd.exe 95 PID 1564 wrote to memory of 608 1564 temp.exe 96 PID 1564 wrote to memory of 1224 1564 temp.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber > C:\Windows\Temp\baseboard.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic logicaldisk get volumeserialnumber > C:\Windows\Temp\disk.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get volumeserialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_computersystemproduct get uuid > C:\Windows\Temp\uuid.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1224
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Temp\baseboard.tmp
- Size 6B
- SHA256 2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
- MD5 bea07e6d2b8dce396fe21baa61b34956
- SHA1 665332b36fc8fa1ed11210cdee83b639b451e592
- SHA512 4ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\disk.tmp
- Size 178B
- SHA256 42cdfdb74ff029c032b1e471e0cec94ce0fb0ec2fde6cec7882baa6fe0efd5da
- MD5 a0131364e62e00053d1db6d8a01200cc
- SHA1 b2558a15e7dab32883bfafc7edde361968dd5278
- SHA512 f6afe8104c5e1570d985b98788e689130340dc00efe4b59e8573579df078a36ee1aa15d4ea6ed93d95276bf5b3b96f86ad27466a10ce3e8af0c14eca070cba0b
- TLSH T14AC0110B8EEC002BA2C28008ACB0803E83F3320B0ABC2A2C00CC2223C3E30003B003CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\uuid.tmp
- Size 162B
- SHA256 b323dcb8a0ab72cf53451e53ebab7548a922c51a132e7a73c14b3121aed9cba2
- MD5 d1e4d144596dc91c25d08e2ec4243a3d
- SHA1 6d1fb667658eb49dce2a3d84450e4721a5f0096a
- SHA512 0aa388d04b9985daec38a7d45306b01912b9cb4dc1f76db0db2fe6a7285984f533920f613be00f4fcc535dfe968ce54b39650f259f001472725a85167ac32589
- MD5 SHA1 SHA512