1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe
Size 8.6MB
Sample260727-trcaraxtdw
SHA256 1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e
MD5 a37ca5b911d31bd55eae2b9124d4197d
SHA1 80d2edae20e97edfdef1939b38ed8c16de83e4c5
SHA512 bc4ffc033a696033de2a9ec5989c8a064e269369a5c3271b1fe894c2da7f63ec0c829b6ac49af8a7f9d59e4b2717b9e1b149a238802577d971f1eb1be841605c
SSDEEP 196608:SVgTVOwCIc2WHsBahY/4qxDRw87O74+C9PNjAGWtS6qLAU:3IBYH79AP
TLSH
T104966C21B7B18025F17706309A2DB76AA5AC7E72173480CBF3C49B6E29F15C29935F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	120	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe
Token: SeRestorePrivilege	120	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe
Token: SeSecurityPrivilege	120	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe
Token: SeTakeOwnershipPrivilege	120	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
120	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe
120	1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe

C:\Users\Admin\AppData\Local\Temp\1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe
"C:\Users\Admin\AppData\Local\Temp\1104143f00f42b4346c99f233ef4ef80a7e5c57ff7fadef51f145197a3294d7e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads