f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe
Size 4.7MB
Sample260721-tpecbsxwdv
SHA256 f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce
MD5 4ee6804f5a59809c2796e562888f36a0
SHA1 09d945cf368978d02a243505258dce665e32b9cb
SHA512 09d28b6f0bccb5d882f15137d32734070eb20a80baafaef42ef5751d48d7f992f4539b093e09b1d80b34331adc96cc4e82c24f0f54f9f1b72808f7cd97d9feca
SSDEEP 98304:a6/wd690/G0YsMiFmpR4/6XdY85IXsZKj3783tjhGbJYoiBQJdzzNdv10lF1NN8z:aCwd6902+/cAkymdONdv1i1v87
TLSH
T10236AE31B2A982B5D60416B9032A733B6538A731473D81C7F1711DB66AB2AD36C3E3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4788	f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe
4788	f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe
4788	f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe
4788	f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe

C:\Users\Admin\AppData\Local\Temp\f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe
"C:\Users\Admin\AppData\Local\Temp\f8d89d69e3a08e90375a3b4f6d375a36a3ca35cc8ed19a7d414dd8f7ab5ffbce.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads