Analysis
- user interaction
yes - max time kernel
30s - max time network
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 14:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Build.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Build.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Build.exe
- Size 434KB
- Sample260728-rfwtxahf48
- SHA256 87b9a23347ab104431799fef9fc7fdb68259357ff4c79de875c10e0363e78d3d
- MD5 ef013a6ff0aaa1c88f219d6099632de1
- SHA1 c9e96de36a82e0b07dd3467983f1bed62aef4f71
- SHA512 fa77865ac8d1b1fc48e93c50fd3e16c27e3eb92ee2b9e5455ea86ca34b536ae3e605a3b2330430e003611342320b81231e4ecbb912a0687a3168d07607c409a5
- SSDEEP 6144:xyprSU4jpy5cni816631dW1G/vGEn3sNWpuLFd6Fyy6wBboksqAU41zHoa5fYdk+:xMSU4joci8M6PW1GVFeFd60DFUy1Yk
- TLSH T18B947D27F6D08437D16336B99C1B9A98A9257E501D24244A7BF83E4C4F39383FD2629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Build.exe" Build.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Build.exe" Build.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Build.exe" Build.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Build.exe" Build.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 6008 Build.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 2688 Build.exe 6008 Build.exe 2688 Build.exe 6008 Build.exe 2688 Build.exe 6008 Build.exe 2688 Build.exe 6008 Build.exe 2688 Build.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3344 LogonUI.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5136 wrote to memory of 6008 5136 userinit.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Build.exe"C:\Users\Admin\AppData\Local\Temp\Build.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2688
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\Build.exeC:\Users\Admin\AppData\Local\Temp\Build.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6008
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a23055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4200
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4960