8e5ff6948d71e8dba1ae568ea8ff13fa15ba12c7acd391920da6f7e1d44db382

Analysis

max time kernel
164s
max time network
167s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hello_World_ver331_5_x64.exe
Size 413KB
Sample260720-hll28abz2w
SHA256 8e5ff6948d71e8dba1ae568ea8ff13fa15ba12c7acd391920da6f7e1d44db382
MD5 afe1f10b45ced9a8d8af2bc4a51d93b6
SHA1 7f9879d12863d919848ad21ed8e1144d64645459
SHA512 2bc2b98cb3d15fd3c3b2516c240f9c1ad064dbe7b83b811ccc274848cb9796414e2a46323ccc7a2f6bc92d4643f7c8828d6bf729957bc17efbd21235e92a39cb
SSDEEP 6144:okMwHkfW6YWh3DiQ6veayls3/fEP+9d5sBfHC6UsoSfYvL95Xze+:okTXkFxlaBd5sBKKo/Z5Xq+
TLSH
T14694E6B2BA7C119FEB7B9AF498C05931B6136C2D915465250B88F114A932FEDF860F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2592	sinubzclz.exe
3212	sinubzclz.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4540	schtasks.exe
4256	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2592	2444	Hello_World_ver331_5_x64.exe	90
PID 2592 wrote to memory of 4540	2592	sinubzclz.exe	91
PID 3212 wrote to memory of 4256	3212	sinubzclz.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Hello_World_ver331_5_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Hello_World_ver331_5_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Public\riyj4237iy\sinubzclz.exe
  "C:\Users\Public\riyj4237iy\sinubzclz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\schtasks.exe
    C:\Windows\system32\schtasks.exe /create /tn "ncjOLQsCLFVb" /tr "\"C:\Users\Public\riyj4237iy\sinubzclz.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540

C:\Users\Public\riyj4237iy\sinubzclz.exe
"C:\Users\Public\riyj4237iy\sinubzclz.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /create /tn "JJXkgmUDY" /tr "\"C:\Users\Public\riyj4237iy\sinubzclz.exe\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

etxmh.cfg

Path C:\Users\Public\riyj4237iy\etxmh.cfg
Size 6KB
SHA256 ad9e50ad8825aea6a3cd7a8e12f1f00955f66df4698c5d9be2f48ab6b5066b1b
MD5 c2ce68718d832623e0ac65dd1ad7da66
SHA1 16c85e69adcea3ff86e5052212b0ef463910b944
SHA512 d67014dcb120498c004899149ced8c871d970e580e6db662c9bdf645c43e9bdb7d25550e63a905c83b2e0a632162e29b4d22035ffd7a5370aed190cc88a29e62
SSDEEP 96:9I5XKS6kzuRWtYAVBQ09SWxs97/tk1oG6NVgJ0bUGV25DsqJJZ02hFA8m5D:yZTzuRQLB59Xxmu1oYFmxwZ02hd0D
TLSH
T108D1B060993999B76C214E3A594F4B9CC424857B107330FE48A39D5AC6F8B68FF211CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sinubzclz.exe

Path C:\Users\Public\riyj4237iy\sinubzclz.exe
Size 199KB
SHA256 427f51e4b519050de775d16e4ac6c1c41cfe8d2336a3e2f641369f25ed56cea9
MD5 3615da2fa53529eb11eb3f3bc5dca876
SHA1 10deed7afbdd2548935f181d6caefa2f7977e69f
SHA512 311fd3a650e058b6700f9e920cff6ee356db7e52b01c7e1f143a6a1d422e79cb83173ed6a501b9c211dd7ba3b32677ee389a1e885e17b92da5f7b9ead78e7a67
SSDEEP 3072:+Ae9XyoILcvlan4PoCiPHquM0Y3raL970Usow1KZWKQqJ1I8PNB6+9mDTorXnrm5:uhIn4P/kHgmLuUsoSfYvL95X
TLSH
T1EC1429E2F69420E9EDB9073840D52E39B767BDBEB624576F0684F5152E33BD10C34A22
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads