aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe
Size 3.1MB
Sample260709-rm76hsby6j
SHA256 aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb
MD5 f55098e788505b1fedabc82e289f9984
SHA1 7663388a9ad097934e341c9e7ea14787e2211cc9
SHA512 6e3511efd40b3c382495a0a83c5e25973235454104ed7a57caa3811bc8ca912d79dbb7b9b86c55477608d257693d8d5193ae12f14b23f0cefda2de8cf0f60a1b
SSDEEP 49152:RY53BaxSNNIP6o9XD5NDDZIhhid97Mq/ePv4TWC2Px+Y++W965CGSB716Iy:RcRa8he7Mq/OvcG+YII
TLSH
T18FE5AE117A81C432E56201F54929ABFE4479FE202B3181C3B7FDBA5E0B706D2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1328	aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe
1328	aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe
Token: SeIncreaseQuotaPrivilege	1328	aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe
Token: SeAssignPrimaryTokenPrivilege	1328	aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe

C:\Users\Admin\AppData\Local\Temp\aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe
"C:\Users\Admin\AppData\Local\Temp\aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads