dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Size 1.9MB
Sample260715-v79fvsdx2w
SHA256 dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59
MD5 a6d2fb8459e916f4f608b67d371b8a6b
SHA1 f49c5fd71bc118685b389c08484c7a7f4bd4f5d8
SHA512 2eb21e319b6945487e752a0fb60f5166cb96ac7c6477708319018c69880ffc78119d8fe1ae0886abeb665c55f29794ca754060e5872c021db0cfc74277fa8d1a
SSDEEP 49152:Oq7kwk57k599qO4wab2BggUSuzG87zzGafVx:lI9U9q9wabOghJ7zzG6
TLSH
T17F9533D5113A5604E88B74B4D22EFD612208FC2C899947A337BBFE4AFD30B6A0755277
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\gjuCBwNSVmY6L.sys	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
File created	C:\Windows\System32\drivers\fJSEn4vKPQ.sys	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gjuCBwNSVmY6L\ImagePath = "system32\\DRIVERS\\gjuCBwNSVmY6L.sys"	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fJSEn4vKPQ\ImagePath = "system32\\DRIVERS\\fJSEn4vKPQ.sys"	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe

Executes dropped EXE 2 IoCs

pid	Process
4332	5A6B.tmp
5272	5C8E.tmp

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6112-0-0x0000000000DE0000-0x0000000001331000-memory.dmp	upx
behavioral2/memory/6112-14-0x0000000000DE0000-0x0000000001331000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Token: SeShutdownPrivilege	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Token: SeDebugPrivilege	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Token: SeDebugPrivilege	4332	5A6B.tmp
Token: SeDebugPrivilege	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Token: SeLoadDriverPrivilege	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
Token: SeDebugPrivilege	5272	5C8E.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4332	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe	87
PID 6112 wrote to memory of 5272	6112	dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe	88

C:\Users\Admin\AppData\Local\Temp\dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe
"C:\Users\Admin\AppData\Local\Temp\dd16713b0971d147923b9d4bec787f5ae65fa78f718a226e3c90d491c3a1de59.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\AppData\Local\Temp\5A6B.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A6B.tmp" 668
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\5C8E.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C8E.tmp" 704
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5A6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A6B.tmp
Size 463KB
SHA256 8a6333acae42500e787088e88a7d346120fc00606cdc89918d097c90379862ef
MD5 dc9742b6fa4086e87e41a1858e116bbd
SHA1 6bc590fc950aa213c46d57e0f886b29d8dfa7307
SHA512 0dd50552e07d820a9d410065ad5e885c40a0520c4353a9ab3d4bd9fbae4f11c1090314d625bbdad64cf99a2990e609a98942c57dc989336323cd2db7e5631608
SSDEEP 12288:Veq98eSx5cA1zXpDm649VCClXyctmS5V2NDXuFxkx:J9Fka8Xpe9VCClXyctmS5V2NruFxkx
TLSH
T1F9A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6112-0-0x0000000000DE0000-0x0000000001331000-memory.dmp

Download

memory/6112-1-0x000000000132F000-0x0000000001330000-memory.dmp

Download

memory/6112-14-0x0000000000DE0000-0x0000000001331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads