c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe
Size 11.9MB
Sample260728-p6mb2shr7s
SHA256 c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040
MD5 79da749c102b44d998359ff79c34751f
SHA1 c6bd5228ab12327f068073eb8fea95f464a93b40
SHA512 a04ce5ff9d50be5e50ba12a559c01c7c84b0b2fd883539688fb76ebc288c37af144d04fdedce82ca7bb80e2ac4e0eb523f39331bcf5d6f79dc757a65730fabbd
SSDEEP 98304:cBqE0i2v6Qc2reya09GqoKcFYP307yiAW2UD3NPFBkf5VWU9MTn:cF0ipKX+7qP307yHqG5VWU6
TLSH
T1C7C66B1173F88A2AF5FF1B78A930012597B6FD42AB72E34D1558A5BD2C637908D603B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 5716	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	89
PID 5404 wrote to memory of 6008	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	91
PID 5404 wrote to memory of 5760	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	93
PID 5404 wrote to memory of 4632	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	95
PID 5404 wrote to memory of 3288	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	97
PID 5404 wrote to memory of 5324	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	98
PID 5404 wrote to memory of 2624	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	101
PID 5404 wrote to memory of 1488	5404	c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe	102

C:\Users\Admin\AppData\Local\Temp\c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe
"C:\Users\Admin\AppData\Local\Temp\c9af921a0b9dfcd7fe2773b1c836b8be901f7fbf7527cc366522c51e2ace8040.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
  2⤵
  PID:5716
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
  2⤵
  PID:6008
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
  2⤵
  PID:5760
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
  2⤵
  PID:4632
- C:\Program Files\Java\jdk-1.8\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
  2⤵
  PID:3288
- C:\Program Files\Java\jdk-1.8\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
  2⤵
  PID:5324
- C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:2624
- C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 4a097b741571a1f064373c566ecb48cabe9caedac70a648a1ba9e08c493c2a8d
MD5 fe186ea215abb1850f0b941aebdf142e
SHA1 f5ca6a55ab3c3db49e398ffcb16536a1992edb83
SHA512 9483ec9ba5abcfac74ac819869cc76146a91b99e5fba4c10363980796b209a86328e2622a48f354bd72d8d7bb147eef3b5938702257c5ccdb62e17f857aa84c7
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 214a22e215d34d4a5b43f7c6a362bc16a2c466740fddbda5b72540498249e4fa
MD5 ea7bec911913532346811b617561ac67
SHA1 43db1e552ecb8adf1a2445f385d510746db48b99
SHA512 3ef09c64c519fb9e88c08b89aa24aa81feadde0e45f4552f7be79e215192eaee0ddc996b2e466967267258f1328b665df134a76ce326c1869be80a9c3e850fc6
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 0720674709be0fc1a56ecfd1fb0de08f7d79a8d4e7bfdccab5e08bbb95e80d6f
MD5 5d7a9ae29000d9d393adf86a7954f7f7
SHA1 54bd38eca6e1c8837fde13d1c5b794e33e8c262f
SHA512 909bd6986f8e4ba8420b2ee7ff6f723b52dc29ccdc73084209c827cc9086e3a941b0d7bb21178a49d1d10ea2abd414d287ef99e378099ba1ee2b84e8241750a6
MD5 SHA1 SHA512

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 534d15b253bb021e8fa086cabbb6cfa4f52d83594fe2e531e542cdd37df4be36
MD5 ef6becd49b3c079b918ac8fd88e963b8
SHA1 b63dc62e22ad63745543dd31c87d7e5f6456ec33
SHA512 0dd527d82058a7852cd74fdea361cb067a5ae95c3e7e1ff04130b3474a66995e18d21bdfd06b6461a9d00f56dc2cef6fe51758b68e3df792efff7c4d0b8ba641
TLSH
T13A9002AC5C44C641308115905B016895038D4544155D0019934C5B87D894654AA15DE1
MD5 SHA1 SHA512 TLSH

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 4027108f0a820bf74869d73be2020c5883ad51161f9f6bbda53ee57bbab3a2a2
MD5 153105d5ea82e26dc7c7471c0d5bc47d
SHA1 b7b1aa1a44e544657e3f2720718402b92d0bdd13
SHA512 c7148bb5bc30818b4f0ff8f34b434175d74bd1af931fc34562750d7a54489557b326447fc6b90c96b1b09320d0e254f127da32591e93821be66768af09da93e6
TLSH
T1049002A85C84D541304111C01B016996038D4554159D005D93884757D8947105A1ADA1
MD5 SHA1 SHA512 TLSH

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 efb784ded6a1b4205211c2a52405682e5aafae597440867b2821b0a7fd9fa285
MD5 1eda23fa1cc41ecc70c3a09623fafe95
SHA1 99adca8616224c09d7c02a51ed56c17f32d47cf0
SHA512 b9ba4c87c2f2511579ce10379633fb92bb77a5682d133b7e7d6b4c089646238ce1bd652c8454b05c32c4a4dd72ed2018ca17baa3957224eae2cf16721f602ee8
TLSH
T11D9002A85C44C541308115805B0168A5138D4544155D4059938C5B97D8946545A15DA0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\BHL\settings.json
Size 1KB
SHA256 eb2a5c8de2f638cb4e96768d62522f81b2aae39d696d4041dbee2e3e7c5e04c1
MD5 b55da7bf0cef5e0080c5174c1766b878
SHA1 8b73654dfee9dad25d92ccb68b81f0cba06eb65a
SHA512 7a2b73a89bb2aaf39c31e9ab9dae585143051d60be4fbdbb179e2c967c459642bed38bf04c912e96cfd78696028c9a32fd97c5bc234f239bb32f8be70324ba1e
TLSH
T1D021EB12E206E67F37B9210856B9595350320F8F61303D6FBDBB6C4853AA92B24C7F67
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-104-0x000002D9F81F0000-0x000002D9F81F1000-memory.dmp

Download

memory/2624-105-0x0000023BEC090000-0x0000023BEC091000-memory.dmp

Download

memory/3288-81-0x000002084A520000-0x000002084A521000-memory.dmp

Download

memory/4632-56-0x000001A596DA0000-0x000001A596DA1000-memory.dmp

Download

memory/5324-80-0x000001F6E55C0000-0x000001F6E55C1000-memory.dmp

Download

memory/5716-6-0x000002176D080000-0x000002176D2F0000-memory.dmp

Download

memory/5716-19-0x000002176D080000-0x000002176D2F0000-memory.dmp

Download

memory/5716-16-0x000002176B900000-0x000002176B901000-memory.dmp

Download

memory/5760-46-0x0000021DF39B0000-0x0000021DF39B1000-memory.dmp

Download

memory/6008-29-0x000002247B920000-0x000002247B921000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads