Analysis
- max time kernel
298s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
छंटनी की सूचना.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
300 seconds
Behavioral task
behavioral2
Sample
छंटनी की सूचना.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
300 seconds
General
- Target छंटनी की सूचना.exe
- Size 2.7MB
- Sample260721-tx163acd67
- SHA256 2e59f14fa76be0e8ab9b36b081a52cc498f71380ab2589eafc49db049e5ca190
- MD5 350797950ca16b138a0669057e7ddd12
- SHA1 c64c4ec2dddf74b4234e090c120fe2daf637ac0e
- SHA512 7ff62e41987db295cfef529e62f11a6c1f5a171b2e7147a55e18ef90c1eaf12677289588b0d67eb2a5809309d4cdf3adae2f745bfa677a873ab9bc15d5eefe21
- SSDEEP 49152:9aSn5VvqSLiZ65+CT0zwwaLIF8bAMXXLtiIKBt9zvod:/oSeeTuzD8bDx2
- TLSH T17DD5E00EE74688F6C01A84B80D4805EE1735BD8A8E405797B3DD7171FD97AFEAA3C285
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" छंटनी की सूचना.exe - Windows security bypass 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths छंटनी की सूचना.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes छंटनी की सूचना.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions छंटनी की सूचना.exe - Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" छंटनी की सूचना.exe - Executes dropped EXE 3 IoCs
pid Process 3880 timeout.exe 5456 AppProfileSvc.exe 4432 timeout.exe - Loads dropped DLL 4 IoCs
pid Process 3880 timeout.exe 3880 timeout.exe 4432 timeout.exe 4432 timeout.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions छंटनी की सूचना.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions छंटनी की सूचना.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths छंटनी की सूचना.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes छंटनी की सूचना.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftNetProfile = "C:\\ProgramData\\Microsoft\\MicrosoftNetProfile\\timeout.exe /t 53814 /nobreak" timeout.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Modifies Security services 2 TTPs 4 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" छंटनी की सूचना.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" छंटनी की सूचना.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" छंटनी की सूचना.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" छंटनी की सूचना.exe - Delays execution with timeout.exe 2 IoCs
pid Process 4432 timeout.exe 3880 timeout.exe - Kills process with taskkill 19 IoCs
pid Process 6100 taskkill.exe 5872 taskkill.exe 3212 taskkill.exe 1044 taskkill.exe 1312 taskkill.exe 4608 taskkill.exe 2008 taskkill.exe 1812 taskkill.exe 4800 taskkill.exe 2736 taskkill.exe 468 taskkill.exe 5796 taskkill.exe 1404 taskkill.exe 1420 taskkill.exe 4576 taskkill.exe 4244 taskkill.exe 5372 taskkill.exe 2684 taskkill.exe 3356 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 छंटनी की सूचना.exe 1820 छंटनी की सूचना.exe 1820 छंटनी की सूचना.exe 1820 छंटनी की सूचना.exe 1820 छंटनी की सूचना.exe 1820 छंटनी की सूचना.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe 3880 timeout.exe - Suspicious behavior: LoadsDriver 14 IoCs
pid Process 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 1044 taskkill.exe Token: SeDebugPrivilege 1312 taskkill.exe Token: SeDebugPrivilege 5796 taskkill.exe Token: SeDebugPrivilege 6100 taskkill.exe Token: SeDebugPrivilege 1404 taskkill.exe Token: SeDebugPrivilege 5872 taskkill.exe Token: SeDebugPrivilege 1420 taskkill.exe Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 4244 taskkill.exe Token: SeDebugPrivilege 5372 taskkill.exe Token: SeDebugPrivilege 2684 taskkill.exe Token: SeDebugPrivilege 3356 taskkill.exe Token: SeDebugPrivilege 4608 taskkill.exe Token: SeDebugPrivilege 2008 taskkill.exe Token: SeDebugPrivilege 1812 taskkill.exe Token: SeDebugPrivilege 4800 taskkill.exe Token: SeDebugPrivilege 2736 taskkill.exe Token: SeDebugPrivilege 3212 taskkill.exe Token: SeDebugPrivilege 468 taskkill.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1820 wrote to memory of 1044 1820 छंटनी की सूचना.exe 91 PID 1820 wrote to memory of 1312 1820 छंटनी की सूचना.exe 94 PID 1820 wrote to memory of 5796 1820 छंटनी की सूचना.exe 96 PID 1820 wrote to memory of 6100 1820 छंटनी की सूचना.exe 98 PID 1820 wrote to memory of 1404 1820 छंटनी की सूचना.exe 100 PID 1820 wrote to memory of 5872 1820 छंटनी की सूचना.exe 102 PID 1820 wrote to memory of 1420 1820 छंटनी की सूचना.exe 104 PID 1820 wrote to memory of 4576 1820 छंटनी की सूचना.exe 106 PID 1820 wrote to memory of 4244 1820 छंटनी की सूचना.exe 108 PID 1820 wrote to memory of 5372 1820 छंटनी की सूचना.exe 110 PID 1820 wrote to memory of 2684 1820 छंटनी की सूचना.exe 112 PID 1820 wrote to memory of 3356 1820 छंटनी की सूचना.exe 114 PID 1820 wrote to memory of 4608 1820 छंटनी की सूचना.exe 116 PID 1820 wrote to memory of 2008 1820 छंटनी की सूचना.exe 118 PID 1820 wrote to memory of 1812 1820 छंटनी की सूचना.exe 120 PID 1820 wrote to memory of 4800 1820 छंटनी की सूचना.exe 122 PID 1820 wrote to memory of 2736 1820 छंटनी की सूचना.exe 124 PID 1820 wrote to memory of 3212 1820 छंटनी की सूचना.exe 126 PID 1820 wrote to memory of 468 1820 छंटनी की सूचना.exe 128 PID 1820 wrote to memory of 3880 1820 छंटनी की सूचना.exe 130 PID 5456 wrote to memory of 4432 5456 AppProfileSvc.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\छंटनी की सूचना.exe"C:\Users\Admin\AppData\Local\Temp\छंटनी की सूचना.exe"1⤵
- Modifies security service
- Windows security bypass
- Modify Registry: Disable Windows Driver Blocklist
- Windows security modification
- Modifies Security services
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\system32\taskkill.exe"taskkill" /F /IM MsMpEng.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM MpCmdRun.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM NisSrv.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM SecurityHealthService.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6100
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM SecurityHealthSystray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM smartscreen.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5872
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM SgrmBroker.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM HipsTray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM wsctrl.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM usysdiag.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5372
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM HipsDaemon.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM QQPCTray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM QQPCRTP.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM QQPCMgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360Tray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360Safe.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM ZhuDongFangYu.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM avp.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM ekrn.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\ProgramData\Microsoft\MicrosoftNetProfile\timeout.exe"C:\ProgramData\Microsoft\MicrosoftNetProfile\timeout.exe" /t 53814 /nobreak2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
PID:3880
-
-
C:\ProgramData\Microsoft\MicrosoftNetProfile\AppProfileSvc.exeC:\ProgramData\Microsoft\MicrosoftNetProfile\AppProfileSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\ProgramData\Microsoft\MicrosoftNetProfile\timeout.exeC:\ProgramData\Microsoft\MicrosoftNetProfile\timeout.exe /t 53814 /nobreak2⤵
- Executes dropped EXE
- Loads dropped DLL
- Delays execution with timeout.exe
PID:4432
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\MicrosoftNetProfile\AppProfileSvc.exe
- Size 193KB
- SHA256 5fb5f57ac80867099b55edcdc33ac9cdd8fa2f1a44a3affa2dc2432844e65f76
- MD5 b51ab8b477ee1ad1c6a0f4fd7903d066
- SHA1 4e700d66e0251284179ca2bfe5d7053dc705c199
- SHA512 9d315a4795e6e054be2cc5672275853ad0307206b05528938b9b01fbb0410c803313083777055889634e33bfe636af6315d2493092c039f090410247190238b0
- SSDEEP 3072:ukiGPjxZqpARXuPCPfbmtr7b4UUwg8lhSbHpkbEvcC/IkSzJGP3:P7qpAJuBHb4UFhwJkb9CQg3
- TLSH T14F147C12B79550F8E067C078C6514A52A77674860B21ABFF03B44339AF667E6BF3CB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftNetProfile\VERSION.dll
- Size 13KB
- SHA256 6918c1c3a48dc7ba93ead25f4b5f4059468c2234c401d77f20f85d93a7d38891
- MD5 ecdc03c258b6536e2162feaf51097519
- SHA1 9a8cac0d8276c1bdef4cf45760e36a09d0c1ca72
- SHA512 69f77c7a189d539f2cee633dfab32e6cb15bedb876aa832c89436a907dafe6267e9413915886b2547724cb653fac970475b1f093695b173e91fff1aa6c134cb1
- SSDEEP 384:vXCENn5og8rMTQG2GfbgNpP6EkFmM4mP6XzNR:vXCENn5og8rHGF06EymM4mP6X7
- TLSH T1FF523A52274900B5CCA742FB9273142526FC318990A6E82E12FDB16CBFF3989172B7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftNetProfile\cache.db
- Size 329KB
- SHA256 dc37d9d55e0d8c1ec1dd04fad1b75d23c13ac6350c8be9d271458a4759d3e5cd
- MD5 412461bed29aed2062d10a9e580023c4
- SHA1 0b7cbc2ea395bf27f7f805767e60f01ed309b7fd
- SHA512 50a9978db005d2e025647249d350d0215bd56dc85345316e07606c0bedfdeafcaae1e564f79e4cb24c00bdd04c8b73c83d112bca431dc70c8d36a8c5925841e6
- SSDEEP 6144:tecgEnRtBBpAPy9x8KgtqJvOEmtrl3p43Ag1ck/zsOCaDCUWUUAo+E3g5eWOCunt:ccgutBBpnDLmtJ34AGckwOCaqUUAoVuQ
- TLSH T18674E125F2A54E7E1F272AED908E48EF98CF9EE352CD002A27F192D58F50594801FD5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftNetProfile\metrics.bin
- Size 380KB
- SHA256 8cf7a0c948e4efa17cea2749ea9a55cc9022afc1dfdc8cbe63e997a1264762de
- MD5 b661634b93139bcf3c9d65603709d83c
- SHA1 526a56e1387fbaf830e185ac951bcccfce846df2
- SHA512 5cacf06e81208333ec5e2f3ea0358a3f8a37abc0ea5d48c43bffdb70d261c7e3b1ff21142667dce23caa26e062be5a0f91390e550f02f2b68a24d8b91d3996e3
- SSDEEP 6144:v8YuJLk5Q/L4wJupK3XBrL4rx+ernN13A/8kTMWvJ+OLwticV5iA3mFEfKqe2pHB:9uJgyLDUWXB34brNFCrQcIVYMm0dB
- TLSH T1BE84CE94DAD35DAEE9384EC9E0DDE0DD2398824341C30BC76AF5C9714675E346A8E42F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftNetProfile\timeout.exe
- Size 56KB
- SHA256 106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1
- MD5 39417af218ca9916633d4d9c979dc443
- SHA1 0d7077cd7516abe34da8af05cad61e84afb756a5
- SHA512 f1e4fa01793f3e6148be764fc802dadd587e2d24c7df64ab5b1eeb3baa967e618748bb67cb775314a48d8fe98b769271c901948ec21c51800d1cb605ca9860ab
- SSDEEP 768:d9S/frK5u9ViA9ZlxHTsCHt2XHVcHf31KAV6xrc/vBOvF:dOuw9jfAaIcHflN6xE2F
- TLSH T1CB43081D62A430F8E466927CC595031AD235B53237A153FF13F4C7366B23ADAA63AE41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EneTmp.tmp
- Size 18KB
- SHA256 38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0
- MD5 66066d9852bc65988fb4777f0ff3fbb4
- SHA1 24343ec4dfec11796a8800a3059b630e8be89070
- SHA512 ef2d9b892bedb9afb395935fa9b632d68593fc0c10f355d343b28117c6fc726899feddace54ad94c7b4f7614d725019b84c784596447651f24eb089f4cb329a0
- SSDEEP 384:8AZeRSx08gp2JY8cHZg2KxnYPLQa6jjqoneMh:8drkuXHZg2KxymD
- TLSH T127824C9B4A2510E3CDEAC674C186E177FC70B2512FB851CB90B485862E96BE02F3D30E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SDx_A446.tmp
- Size 37KB
- SHA256 9f8cea3f6fbeef249285604ada85c98c1686001b31df0f3805905556828b3ae3
- MD5 2060638c4612a1b922395e9cc00011cd
- SHA1 63ae5b0e928653f7cdd40ad212583a25d6a0e1f1
- SHA512 969bbecbfd57eca51e1d0e8e67c28308aee61fc2b6e1e05cc0f4b5ae07891c663f73df58ee8167e05ceb699d0b221112c3ece44faf277a63aec5ee814babc116
- SSDEEP 768:8j4C3bSyX0iZR64cTc36PWuaHdzD8ALvjshttkVIrr9z0d:8j44NRtiedzDakVABz
- TLSH T1A6037C8696E850D1DEAFCA7442B5C9977DB536432701AADF02A4C0B91E33FC0B63DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ms63b7f2f6.tmp
- Size 380KB
- SHA256 c3cdc4f4b9e8be1f8868fa21c44aeba608c53109bd049a546a060fac8af3ba58
- MD5 13dd8c54391f55ac95e36128440a335d
- SHA1 098eee3357d810ad86c2d3c213956b6d8dc5a65f
- SHA512 22b0f1159902699429663e22b7d14373853cdb1d6de61a2b8175af4d690c2cf9643ac022a25516d4f2f82a5c86519e32ac878fe373e4677a81d4d21f9ef4e59b
- SSDEEP 6144:YT60CP5rjWz5QjLYkhEtHChTCOF/mA0c5Jqzik7cI56H8gac7NuldYZOoTi:M67JWC8khER2mg5oz1wO6H8gfNuMni
- TLSH T1A684DF15F7E148F9EA378ABCC09F018AA667B8960394D21F17F04BA15F523D0853EF69
- MD5 SHA1 SHA512 SSDEEP TLSH