8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Size 1.9MB
Sample260712-vbcf9afv91
SHA256 8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736
MD5 d2f2945090b289fd0ebb9934a5f3720c
SHA1 e25b0ee04d2a63332155912fb6d0e224e784c6f9
SHA512 7e93afa990836695767b379860fb6fce8f4ab9a6998b66c3bbc875469ea559dab99f22f703f285acac6228531a421e17844c74eb4838b58f1a2f7070dd587a4d
SSDEEP 49152:0dthHD5zh1YxNggNlFpYR8xj33ojGVfRF6947lR:oR5zjYLggfYR8xjHoyVfLw47lR
TLSH
T1499533C1A1AA4A71F1E339B9E85BC760AD0DDE270C939096249FBE92357374217CB743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\jveA_gL2Nj20h.sys	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
File created	C:\Windows\System32\drivers\a0KHVtKK.sys	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jveA_gL2Nj20h\ImagePath = "system32\\DRIVERS\\jveA_gL2Nj20h.sys"	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\a0KHVtKK\ImagePath = "system32\\DRIVERS\\a0KHVtKK.sys"	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe

Executes dropped EXE 2 IoCs

pid	Process
4892	7A85.tmp
4916	7BA0.tmp

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3680-0-0x0000000000F70000-0x00000000014C1000-memory.dmp	upx
behavioral2/memory/3680-14-0x0000000000F70000-0x00000000014C1000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Token: SeShutdownPrivilege	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Token: SeDebugPrivilege	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Token: SeDebugPrivilege	4892	7A85.tmp
Token: SeDebugPrivilege	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Token: SeLoadDriverPrivilege	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
Token: SeDebugPrivilege	4916	7BA0.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4892	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe	87
PID 3680 wrote to memory of 4916	3680	8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe	88

C:\Users\Admin\AppData\Local\Temp\8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe
"C:\Users\Admin\AppData\Local\Temp\8895b5d36a0d1c9be97a1b0454cf861b9c87cbf0eb7dacf4edfef41f3e814736.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\7A85.tmp
  "C:\Users\Admin\AppData\Local\Temp\7A85.tmp" 668
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\7BA0.tmp
  "C:\Users\Admin\AppData\Local\Temp\7BA0.tmp" 688
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7A85.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A85.tmp
Size 463KB
SHA256 76cb15001410e9c146e7b6edfd4cd7b7bcb50fb2087cffc2a997b01c20120836
MD5 d139a24afbe7fdbd10f41b539e81f2d8
SHA1 bc8969e74c37ce66168b96a3b7278afedf4feff7
SHA512 8b2c1823ac37168748d025e3f079af96a8e4d3b68e2c6ac1b2fe54ddb847206d4287d926dc11072b931df154c940d891aacda54fb76a2e9f31972201bd7202d2
SSDEEP 12288:zeq98eSx5cA1zXpDm649VCClXyctmS5V2NDtuFxka:b9Fka8Xpe9VCClXyctmS5V2NBuFxka
TLSH
T169A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3680-0-0x0000000000F70000-0x00000000014C1000-memory.dmp

Download

memory/3680-1-0x00000000014BF000-0x00000000014C0000-memory.dmp

Download

memory/3680-14-0x0000000000F70000-0x00000000014C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads