Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe
- Size 83KB
- Sample260730-pbzznahb23
- SHA256 e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5
- MD5 39064bef73cf056832797c38f65c8c7f
- SHA1 1ba552337155f80f53bf8cbf534d1d377c4f272f
- SHA512 05b7f1387f8a4d1ced073c791c851e24fec5fb505d11d88ef846baa5e04110d06ef8bd6f78ae0da07ed51d3dca0760023538fe47d9c543d7eaa9a9ea4f5f4001
- SSDEEP 1536:0cyyjFxTgOUEbwsIWFNJUYQRomRmjC5TNuz:0c3sEssuYQRo8mu5TQ
- TLSH T1CA835A09ED5FE4D2F3603130264E97391D2CBC29B676AD6A2E817789CAF53C0946D336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Helloworld\Parameters\ServiceDll = "C:\\Windows\\system32\\240719671.txt" e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe - Executes dropped EXE 1 IoCs
pid Process 2200 Helloworld.exe - Loads dropped DLL 3 IoCs
pid Process 1048 e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe 5936 svchost.exe 2200 Helloworld.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe File created C:\Windows\SysWOW64\Helloworld.exe svchost.exe File created C:\Windows\SysWOW64\240719671.txt e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Helloworld.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Helloworld.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Helloworld.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Helloworld.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Helloworld.exe Key created \REGISTRY\USER\.DEFAULT\Software Helloworld.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Helloworld.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Helloworld.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe 2200 Helloworld.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5936 wrote to memory of 2200 5936 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe"C:\Users\Admin\AppData\Local\Temp\e829d0dde7dda043bb3811298bd6d5c0dd24b8e7616aea4d490e387e3bce6ee5.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1048
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Helloworld"1⤵PID:4484
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Helloworld"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\Helloworld.exeC:\Windows\system32\Helloworld.exe "c:\windows\system32\240719671.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Helloworld"1⤵PID:1128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\240719671.txt
- Size 72KB
- SHA256 3f0f1f5a83aea637d2cc35b9bfeaae5964e5a2457ddfe54cc9ebc241e2e345f0
- MD5 064a531defddbf094815407d4ffcbecf
- SHA1 1fada2fdb7766c016e9dc37252903886747435af
- SHA512 b98004c94d54848ab5733517cc1588f603e5856eff14a1a326eeb8dea3d5d256696d2f142c7635e7439db4e383f2ba37ea2486b4719d6c19677b8c854d0d64c5
- SSDEEP 768:Ncei3LYqQSdniKN6Y3HDjZIlOQ7YVJUYQRomGor87RdnJnTNmBy:M3LYUnF6CasQ8JUYQRomRmjn5TNu
- TLSH T1FF7307017D6C88E3E291013074465B3A9ABABE3136A7F863AB53778EDE797D0E524107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Helloworld.exe
- Size 51KB
- SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
- MD5 2e068ce2770fde8d1af4cb114b98df1f
- SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
- SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
- SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
- TLSH T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ini.ini
- Size 44B
- SHA256 9a913362d9b1ad79d5b4c70afcd5479396f9365e495e18ad5249fb45bafeb408
- MD5 a705f135d7301da03542ee3adeb17619
- SHA1 4215cca738064ebc05cc5ff5c45f2770015734cc
- SHA512 be7c12dcd27a4b4f4f1279d1bf5ddfd13843eabfc934e4c4a962a0739649aafbc378f10401d140a90e591a4222bd11757240ea7fd802703101e403b99c992047
- MD5 SHA1 SHA512