Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 08:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe
- Size 1.4MB
- Sample260710-ka8sysfz5j
- SHA256 d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf
- MD5 95661c4cab8985553d89f2ed1d918574
- SHA1 85a8a7c5c1872b37dedf1265e443ef6dee14d195
- SHA512 919f11b2ec0520b45305de354fe538f692834cdb993d8d364afc0bad165dbf480e9556c02b1c050f5c65537aa332563beafdec6ad9263d21f42c28a924675fc1
- SSDEEP 24576:yclemaCB5A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bl1aC5ALNiXicJFFRGNzj3
- TLSH T1DA65BD1237F80A69F8F36E3149359F29E53ABC359D35E6AE1140218E2D38A51DE31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5572 d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe"C:\Users\Admin\AppData\Local\Temp\d68bdc3e720846d702728411ed6e68512dbf2749590a2d93b830d40a55fb36cf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5572