a01155ff97c5ae8a06282c867499fc8f338bf76e97da64c756e3aea3ded81696

Analysis

user interaction
yes
max time kernel
22s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
funnything.exe
Size 4.0MB
Sample260730-rxrlhsba28
SHA256 a01155ff97c5ae8a06282c867499fc8f338bf76e97da64c756e3aea3ded81696
MD5 8feaf29f13a5ba36e70c86eec59f3e1b
SHA1 e641eb0097b1798b580a58c649371ccdc47a41da
SHA512 94929083708c3e1a117008d0e3cdfa1faecdd0687fcc2fb5bc8fdd73fe5ab59576374f24efa0c0800e8f08005d932ba6b335b985f23e24d926df64e3f6fdaf77
SSDEEP 49152:3q44bWa6fRgtbjC9oa2IcTWnjpOQl9nwPDC7bODth5yx30GvQ7ppFMbais6yJRPh:3qbCR58b0lFwPD+8th57ppOaV64zAL
TLSH
T1C2168C06BCE005F9C0AAA33289B396963B75BC140F3263DB2F50B6782E72BD19D75715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3296	psexec.exe
1756	PSEXESVC.exe
2608	PSEXESVC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	psexec.exe
File opened for modification	C:\Windows\PSEXEC-XWFPSFRW-26F9ADAE.key	PSEXESVC.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	psexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeTcbPrivilege	1756	PSEXESVC.exe
Token: SeDebugPrivilege	1832	whoami.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4844	2276	funnything.exe	86
PID 2276 wrote to memory of 3296	2276	funnything.exe	87
PID 1756 wrote to memory of 3292	1756	PSEXESVC.exe	90
PID 3292 wrote to memory of 1832	3292	funnything.exe	93

C:\Users\Admin\AppData\Local\Temp\funnything.exe
"C:\Users\Admin\AppData\Local\Temp\funnything.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\whoami.exe
  whoami
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\psexec.exe
  C:\Users\Admin\AppData\Local\Temp\psexec.exe -accepteula -s -i C:\Users\Admin\AppData\Local\Temp\funnything.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3296

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\funnything.exe
  "C:\Users\Admin\AppData\Local\Temp\funnything.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1832

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

psexec.exe

Path C:\Users\Admin\AppData\Local\Temp\psexec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXEC-XWFPSFRW-26F9ADAE.key

Path C:\Windows\PSEXEC-XWFPSFRW-26F9ADAE.key
Size 16B
SHA256 57f4e07a2076e3b971ab1eab645d431a4c9a9775eb4f9ef1bbca3736b6461be6
MD5 1d906d96adcaf52e569ebc15e564806a
SHA1 67386aadc097854a182f738c322c5f0f5390e815
SHA512 8b9b45eec3594764be4fd227f29c907a7f953dc2e39d31ea8876d1ae71baf9419857bd1b18eb9ce637047986eb3c9f1a5b7159a523c95cecc7c499707abfe599
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads