4606b1e9ba4f89810961e606a7cc147d72e56d5aba87c39e189d74a334e72762

Analysis

max time kernel
899s
max time network
490s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
server(2).exe
Size 6.3MB
Sample260712-ae1yssbs7j
SHA256 4606b1e9ba4f89810961e606a7cc147d72e56d5aba87c39e189d74a334e72762
MD5 d71dcfcd5060332ba104c5dd157f2675
SHA1 12376ffae029042309c7e1317f1a79014428703a
SHA512 05469c67b247c846807e723dd899818abf8ce227b998ef9f66d54eef1b67b9f428fff1080f6167c51466b1f9640800a373a4cd037fa6c00dcecdc6c162972f1e
SSDEEP 49152:QzpCnWPU36ZbDK4E5mQdtycw6h73F1uN1ZnfAgjVXtL6/+sTjZa2BsIKWxLh52iI:qCnqwkPOLdtym711XsIKUdQiE
TLSH
T1E1666B11FE8B91FAE903193106A7723F67384D064B25DFD7EB407E6AF8B76910A36205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5116	WindowsHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\SimbMin = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost.exe"	server(2).exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Enumerates processes with tasklist 1 TTPs 16 IoCs

discovery

Process Discovery

T1057

pid	Process
2828	tasklist.exe
1448	tasklist.exe
2820	tasklist.exe
2168	tasklist.exe
5736	tasklist.exe
3600	tasklist.exe
4464	tasklist.exe
4204	tasklist.exe
4368	tasklist.exe
1716	tasklist.exe
1276	tasklist.exe
1332	tasklist.exe
5552	tasklist.exe
5528	tasklist.exe
3904	tasklist.exe
2016	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2692	powershell.exe
2908	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WindowsHost.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3348	wmic.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2692	powershell.exe
2692	powershell.exe
2908	powershell.exe
2908	powershell.exe
3348	wmic.exe
3348	wmic.exe
3348	wmic.exe
3348	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeIncreaseQuotaPrivilege	2908	powershell.exe
Token: SeSecurityPrivilege	2908	powershell.exe
Token: SeTakeOwnershipPrivilege	2908	powershell.exe
Token: SeLoadDriverPrivilege	2908	powershell.exe
Token: SeSystemProfilePrivilege	2908	powershell.exe
Token: SeSystemtimePrivilege	2908	powershell.exe
Token: SeProfSingleProcessPrivilege	2908	powershell.exe
Token: SeIncBasePriorityPrivilege	2908	powershell.exe
Token: SeCreatePagefilePrivilege	2908	powershell.exe
Token: SeBackupPrivilege	2908	powershell.exe
Token: SeRestorePrivilege	2908	powershell.exe
Token: SeShutdownPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeSystemEnvironmentPrivilege	2908	powershell.exe
Token: SeRemoteShutdownPrivilege	2908	powershell.exe
Token: SeUndockPrivilege	2908	powershell.exe
Token: SeManageVolumePrivilege	2908	powershell.exe
Token: 33	2908	powershell.exe
Token: 34	2908	powershell.exe
Token: 35	2908	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 5116	3512	server(2).exe	87
PID 5116 wrote to memory of 2692	5116	WindowsHost.exe	88
PID 5116 wrote to memory of 2908	5116	WindowsHost.exe	91
PID 5116 wrote to memory of 3348	5116	WindowsHost.exe	93
PID 5116 wrote to memory of 2828	5116	WindowsHost.exe	95
PID 5116 wrote to memory of 4368	5116	WindowsHost.exe	97
PID 5116 wrote to memory of 1332	5116	WindowsHost.exe	99
PID 5116 wrote to memory of 1716	5116	WindowsHost.exe	101
PID 5116 wrote to memory of 5552	5116	WindowsHost.exe	103
PID 5116 wrote to memory of 2168	5116	WindowsHost.exe	105
PID 5116 wrote to memory of 5528	5116	WindowsHost.exe	107
PID 5116 wrote to memory of 3904	5116	WindowsHost.exe	109
PID 5116 wrote to memory of 5736	5116	WindowsHost.exe	111
PID 5116 wrote to memory of 1448	5116	WindowsHost.exe	113
PID 5116 wrote to memory of 3600	5116	WindowsHost.exe	115
PID 5116 wrote to memory of 2820	5116	WindowsHost.exe	117
PID 5116 wrote to memory of 1276	5116	WindowsHost.exe	119
PID 5116 wrote to memory of 2016	5116	WindowsHost.exe	121
PID 5116 wrote to memory of 4464	5116	WindowsHost.exe	123
PID 5116 wrote to memory of 4204	5116	WindowsHost.exe	125

C:\Users\Admin\AppData\Local\Temp\server(2).exe
"C:\Users\Admin\AppData\Local\Temp\server(2).exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Roaming\WindowsHost.exe
  C:\Users\Admin\AppData\Roaming\WindowsHost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Measure-Object -Property NumberOfCores -Sum).Sum;(Get-CimInstance Win32_Processor | Measure-Object -Property NumberOfLogicalProcessors -Sum).Sum"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_VideoController | Select-Object -First 1 Name,AdapterRAM | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - System Location Discovery: System Language Discovery
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:3348
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2828
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1332
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:5552
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:5528
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:3904
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:5736
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1448
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:3600
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2820
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1276
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2016
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4464
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4204

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 db77ac54527d75dbe3c15e2daeea2b8cff2bccf66690485abed0718f6910980c
MD5 1c549129245efd06b6657ce719f3575e
SHA1 2e877eb32b45659eb1c2b008e0b6eebd5798a5c6
SHA512 fc2a55f8a14d738e5cf5dfc3da2b7798247d725be6c04455dcaa1f4637408122e00ffee4f59516e61325e4d6610541fe38305bf5953f894db8020607a7c0b3a3
SSDEEP 384:o1eBaGx1i+kGW14btMaEoXoa0+geDrr2PntIAqF4BsfTgle4forsDbhNfPfA/Cc7:kenzZnWiZrrf0+p6FIAySsfHPsbhNfP2
TLSH
T18382E678203F6DC7D89126B054D509E7FBA4D089DEB551D8FF2BCA2F9C90EB64EA0124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_24ufzfhs.al3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_24ufzfhs.al3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost.exe
Size 6.3MB
SHA256 4606b1e9ba4f89810961e606a7cc147d72e56d5aba87c39e189d74a334e72762
MD5 d71dcfcd5060332ba104c5dd157f2675
SHA1 12376ffae029042309c7e1317f1a79014428703a
SHA512 05469c67b247c846807e723dd899818abf8ce227b998ef9f66d54eef1b67b9f428fff1080f6167c51466b1f9640800a373a4cd037fa6c00dcecdc6c162972f1e
SSDEEP 49152:QzpCnWPU36ZbDK4E5mQdtycw6h73F1uN1ZnfAgjVXtL6/+sTjZa2BsIKWxLh52iI:qCnqwkPOLdtym711XsIKUdQiE
TLSH
T1E1666B11FE8B91FAE903193106A7723F67384D064B25DFD7EB407E6AF8B76910A36205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2692-22-0x0000000006E90000-0x0000000006EB0000-memory.dmp

Download

memory/2692-24-0x0000000008250000-0x00000000088CC000-memory.dmp

Download

memory/2692-7-0x0000000075090000-0x000000007584C000-memory.dmp

Download

memory/2692-10-0x0000000005AF0000-0x0000000005B12000-memory.dmp

Download

memory/2692-12-0x0000000006380000-0x00000000063E6000-memory.dmp

Download

memory/2692-11-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/2692-13-0x00000000063F0000-0x000000000674B000-memory.dmp

Download

memory/2692-16-0x0000000006890000-0x00000000068AE000-memory.dmp

Download

memory/2692-17-0x00000000068D0000-0x000000000691C000-memory.dmp

Download

memory/2692-19-0x00000000712E0000-0x000000007132C000-memory.dmp

Download

memory/2692-18-0x0000000007A70000-0x0000000007AA6000-memory.dmp

Download

memory/2692-8-0x0000000005B50000-0x000000000619A000-memory.dmp

Download

memory/2692-23-0x0000000007AB0000-0x0000000007B53000-memory.dmp

Download

memory/2692-9-0x0000000075090000-0x000000007584C000-memory.dmp

Download

memory/2692-25-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Download

memory/2692-26-0x0000000007C80000-0x0000000007C8A000-memory.dmp

Download

memory/2692-28-0x0000000007E40000-0x0000000007E64000-memory.dmp

Download

memory/2692-27-0x0000000007E10000-0x0000000007E3A000-memory.dmp

Download

memory/2692-29-0x0000000071540000-0x000000007189B000-memory.dmp

Download

memory/2692-31-0x0000000075090000-0x000000007584C000-memory.dmp

Download

memory/2692-6-0x00000000053F0000-0x0000000005426000-memory.dmp

Download

memory/2692-5-0x00000000750A2000-0x00000000750A3000-memory.dmp

Download

memory/2908-35-0x00000000712E0000-0x000000007132C000-memory.dmp

Download

memory/2908-38-0x0000000071540000-0x000000007189B000-memory.dmp

Download

memory/2908-39-0x0000000007E30000-0x0000000007FF2000-memory.dmp

Download

memory/2908-40-0x0000000008C60000-0x000000000918C000-memory.dmp

Download