a8a408a432482b312b9a3c263e8dce99ab03a08eaa49e714299e58cedc6f962b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 46KB
Sample260729-dpeebsvxfw
SHA256 a8a408a432482b312b9a3c263e8dce99ab03a08eaa49e714299e58cedc6f962b
MD5 74327ee70c165dff0528c1be0004d6a4
SHA1 65296d0b8ea47f7efba81e8ef66c09d1fd352c41
SHA512 cb568a98925318e63020f999ff82376850750851bdf1a7aeab70416c787ab78a8e747400d6d678a7382817c7723d6d3018742908df66189f10bf54a1a3feb44b
SSDEEP 768:o/nu1DK3OzWtfmnUlcACIDGMm3ow3I5uxXu0II:o/nPO60RIVmYw4Exe0II
TLSH
T11723E60BABA8A438E87152317F752BB102747AB04B6443CBD34A1B5D6D727D1BA313E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Install.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	3600	Install.exe
Token: SeAuditPrivilege	3600	Install.exe
Token: SeBackupPrivilege	3600	Install.exe
Token: SeCreatePermanentPrivilege	3600	Install.exe
Token: SeCreateTokenPrivilege	3600	Install.exe
Token: SeDebugPrivilege	3600	Install.exe
Token: SeIncBasePriorityPrivilege	3600	Install.exe
Token: SeIncreaseQuotaPrivilege	3600	Install.exe
Token: SeLoadDriverPrivilege	3600	Install.exe
Token: SeLockMemoryPrivilege	3600	Install.exe
Token: SeProfSingleProcessPrivilege	3600	Install.exe
Token: SeRestorePrivilege	3600	Install.exe
Token: SeSecurityPrivilege	3600	Install.exe
Token: SeShutdownPrivilege	3600	Install.exe
Token: SeSystemEnvironmentPrivilege	3600	Install.exe
Token: SeSystemProfilePrivilege	3600	Install.exe
Token: SeSystemtimePrivilege	3600	Install.exe
Token: SeTakeOwnershipPrivilege	3600	Install.exe
Token: SeTcbPrivilege	3600	Install.exe
Token: SeMachineAccountPrivilege	3600	Install.exe
Token: SeLoadDriverPrivilege	3600	Install.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3600	Install.exe
3600	Install.exe

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads