24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Size 9.1MB
Sample260721-smaexsyeph
SHA256 24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860
MD5 99956ffc00f12e4b27755724f17a0e02
SHA1 0129ff0a125273822d2d03cf0373acd75af9cf37
SHA512 74eaa71ea663cc17bdf45982838057e4947085bde9ee0b7862e380481e9ae0742fd6724101090b62892f2db4c2abb0c4b0cc8bebc6cc4e9af1427e67a944cdc0
SSDEEP 196608:Xwrl5kD49Oz1RrphnBHrcYz4nx/GEeUNgq0P5tiV6OdZHRGrA8G:Ax58B4W4n5GEFNgq0BgV6OXxGrA8G
TLSH
T1B5A6222265E1CCE7E96E4CB00CF2B6511E6ADD220424CFBB5ED47C4AF174982B23965F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000c00000001c557-19.dat	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
3152	sg.tmp
5788	PrintPDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: SeRestorePrivilege	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: 33	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: SeIncBasePriorityPrivilege	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: 33	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: SeIncBasePriorityPrivilege	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: 33	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: SeIncBasePriorityPrivilege	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: SeRestorePrivilege	3152	sg.tmp
Token: 35	3152	sg.tmp
Token: SeSecurityPrivilege	3152	sg.tmp
Token: SeSecurityPrivilege	3152	sg.tmp
Token: 33	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
Token: SeIncBasePriorityPrivilege	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4772	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe	89
PID 1296 wrote to memory of 3152	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe	91
PID 1296 wrote to memory of 5788	1296	24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe	93

C:\Users\Admin\AppData\Local\Temp\24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe
"C:\Users\Admin\AppData\Local\Temp\24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\~5927745587165210242~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\24d84f19c496f851c10888cae93fa2c30249513e7e6b2dba71a19180e549c860.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~6642159944890797443"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\~6642159944890797443\PrintPDF.exe
  "C:\Users\Admin\AppData\Local\Temp\~6642159944890797443\PrintPDF.exe"
  2⤵
  - Executes dropped EXE
  PID:5788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~5927745587165210242~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
TLSH
T131F49E223BF6C1BBD24201318A1CABF590F5F7590B3059C363908F6D6B399D5D63AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrintPDF.exe

Path C:\Users\Admin\AppData\Local\Temp\~6642159944890797443\PrintPDF.exe
Size 575KB
SHA256 02a33ad3a3b7e708a7f3e4842fd317bc0cd51a9894dbe11154cfb6d1edd552f5
MD5 7e0a05ed4d3ea9735249389d6fa455d2
SHA1 e71b164789d2896de57177ba75381989dcd2bbb3
SHA512 2825aba970f0bbc8b5369c188989e33ba6acc725f0b98a88cfc122aeadd656240e0285b0a889555f97df109d2ef2abdb1492950bb279012460103e97ccb46e1a
SSDEEP 6144:iaIJ4pSXiztvL3d1XeIleM44Iw5dhRBliFFcnZOMSljuG09DLTTtupS:iZSpTtDfVtu
TLSH
T18DC43C5065E1CDC7E42D8D784CF2F2602E664D962812DFB91C823CABF5B2B62B53644F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrintPDF.exe.config

Path C:\Users\Admin\AppData\Local\Temp\~6642159944890797443\PrintPDF.exe.config
Size 4KB
SHA256 877c60a0a81754fe76219e27a5c6c896051bd8df48f7cbf4c522f3ee4be7b168
MD5 de4296744321bc8671fe8493e634fef7
SHA1 957d6d25ebce9f9f428795a62cbfa852cee4d25e
SHA512 cba8f5e7bd8fea98b41eb577470f61b478135ddfbf79c93de8ae19c0e64a92450fb1574cd3780b678ca64f04420f21776ae10fff90c653964b084e7afeecc650
SSDEEP 96:br71A7KtrzZk1MbOHAn2AnQAnKAn7An1AncrsWJYlAnmAnrAnMAnyMAnCAn3An44:br7m7Orzm8
TLSH
T18F91361CB5C1AE9A1176A635E73152D1EDE00523127AB0F0B8ED31676F70CDA4AE33B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5788-22-0x00007FF95CD9F000-0x00007FF95CDA0000-memory.dmp

Download

memory/5788-23-0x0000020B40490000-0x0000020B40524000-memory.dmp

Download

memory/5788-24-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-25-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-26-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-27-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-28-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-29-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-30-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-31-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-32-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-33-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/5788-34-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads