f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe
Size 1.2MB
Sample260718-ppvl4aey6x
SHA256 f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418
MD5 2d5566706592952fe13bd434f5ad59a5
SHA1 be95efe894dab1df2e42b7c995166692cf2865e7
SHA512 d12409cebd5e3c57f83c9836d3566f88d4d731ec99e0e840684f2266cad9eff5afc10cb14e07c5bbbe1c360750d204e300e4293f9095f9de3f024a7f23856e50
SSDEEP 12288:xN814kypjwKbxLIpxNokvML3ogBf7i6QyA8CBdWyV+h5S9:xN8xKtLcokEDfzi6/zCB7V+h5S9
TLSH
T1CE45F11DE76110E4D1E7D57BC89942A2DF69BC15C321DAEB63A06F507F222C09E3AB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2604	WinIo.sys

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1276	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1276	cmd.exe
3376	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3376	PING.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe
Token: SeDebugPrivilege	4336	f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 1276	4336	f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe	95
PID 1276 wrote to memory of 3376	1276	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe
"C:\Users\Admin\AppData\Local\Temp\f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 5 >nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\f7eaae641eb42ad7834e178a15660bc5ea290eb8e906d737d3035d998c4b8418.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3376

C:\Users\Admin\AppData\Local\Temp\WinIo.sys
C:\Users\Admin\AppData\Local\Temp\WinIo.sys
1⤵
- Executes dropped EXE
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinIo.sys

Path C:\Users\Admin\AppData\Local\Temp\WinIo.sys
Size 16KB
SHA256 e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf
MD5 97221e16e7a99a00592ca278c49ffbfc
SHA1 943593e880b4d340f2548548e6e673ef6f61eed3
SHA512 bdc5815845274038295f95687a85d47519590734ec58bf5e262882f7a0368a47363bce331a7ace3f66df0ea6c542436a68fb0038e2bcc56bc2648db17da86728
SSDEEP 384:BdNpI0HuQJV70eDNNinYPL90C07xbhEZYd+O2W:jYCuYNNic0xxbhEpOD
TLSH
T1D1722AA70B297493EFD7893482E68B96BDB4F1406782ADCF907781D01D86FF1267920D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2604-3-0x00007FF714490000-0x00007FF714498000-memory.dmp

Download

memory/4336-0-0x00007FF7F0560000-0x00007FF7F06A5000-memory.dmp