8b64258249dc34d1d7c68324735323190c949f3d9766122676bf7051afc3310d

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_3_.exe
Size 1.8MB
Sample260710-gzedvsfx2v
SHA256 8b64258249dc34d1d7c68324735323190c949f3d9766122676bf7051afc3310d
MD5 27dbebefac44d6947bc6fcc5e7b662da
SHA1 872239b048d6b9f889e3f538b8c909c99f182790
SHA512 bde18aed3250028a6977e555cf094f26be3b31f2053a5e7ec0e2b576255418dcaa453a9e2e8a84c22461fd049128204a6696a1604200cce5674d4878698cb1e3
SSDEEP 49152:pnGcxOUi39yHebZTcNHTXpSliV2s1/ctYmwYDdd:pNYymZZP
TLSH
T193858C92F682C031D5A10572D078D6FE807A6F74E321A9E753DC3EA629319C1E939F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$_3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1000	PING.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	$_3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	$_3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	$_3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	$_3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	$_3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	$_3_.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1000	PING.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5484	$_3_.exe
5484	$_3_.exe
5484	$_3_.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 3004	5484	$_3_.exe	87
PID 3004 wrote to memory of 1000	3004	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\$_3_.exe
"C:\Users\Admin\AppData\Local\Temp\$_3_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8809.bat" "C:\Users\Admin\AppData\Local\Temp\02B9FAB509A04517A69CBB0C46D1E1F1\""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02B9FAB509A04517A69CBB0C46D1E1F1_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\02B9FAB509A04517A69CBB0C46D1E1F1\02B9FAB509A04517A69CBB0C46D1E1F1_LogFile.txt
Size 9KB
SHA256 ce814cbf3df5f9af09932b5bba6d4c3a522505134144cc187ed0f2f829d7769e
MD5 eaf3dc9651ee660229de2f6b9fb5812f
SHA1 31cdf28b39e6bae3eb93dbccdc5a0d9a7d712daa
SHA512 4b3c58ec69044673027fac31de5b42401d486de0235e3cd2b836deaaa01300b181f01f17a2ba8327ad4e58b90fffe07440a4428a3bcb55c71a932e980cb9c6e3
SSDEEP 192:KhAnA0AzArA/wA0A7lACATAFFfA9UA6AbAPATAMAc:WAnA0AzArAoA0AxACATAFhA9UA6AbAPa
TLSH
T19E124B750B02D1E9458414BFE078CFCA2368499FFF74AA58EF2B02C4A6DDB55DA6B1C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02B9FA~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\02B9FAB509A04517A69CBB0C46D1E1F1\02B9FA~1.TXT
Size 53KB
SHA256 e2f16ddab87698073c7ce9817c59eceac6213b806db69e784523cacbe88564b1
MD5 23f70ad6de0f60271e3c361c6e336fde
SHA1 a3975044f82f1bba38ef9cae5cf6e7ff33b3fc6b
SHA512 d1a1e36382e58a16c04537d6f7f2893637ca516f7171f10ad04d5d59fcce8eed1c02757dfb358897fbd1914ffe06469859ea78fb8b1f00a1b3252569403c5abe
SSDEEP 768:WAnA0AzArAoA0AxACATAFhA9UA6AbAPATAMAbAxA6ASAlABxABqAfAkAAAVAnAtu:qd
TLSH
T1FD33917A4642D1FD458428BFA038CFC63324459FEE70A668EF2B01C4A6DDB919B6F5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8809.bat

Path C:\Users\Admin\AppData\Local\Temp\8809.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
TLSH
T188D0C98EBBA5785F4A1A429722D28506470CF0490D57A2C6113068EEBF05A61AABBDC2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5484-65-0x0000000005000000-0x0000000005001000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads