a01155ff97c5ae8a06282c867499fc8f338bf76e97da64c756e3aea3ded81696

Analysis

max time kernel
24s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
funnything.exe
Size 4.0MB
Sample260730-rxrlhsba28
SHA256 a01155ff97c5ae8a06282c867499fc8f338bf76e97da64c756e3aea3ded81696
MD5 8feaf29f13a5ba36e70c86eec59f3e1b
SHA1 e641eb0097b1798b580a58c649371ccdc47a41da
SHA512 94929083708c3e1a117008d0e3cdfa1faecdd0687fcc2fb5bc8fdd73fe5ab59576374f24efa0c0800e8f08005d932ba6b335b985f23e24d926df64e3f6fdaf77
SSDEEP 49152:3q44bWa6fRgtbjC9oa2IcTWnjpOQl9nwPDC7bODth5yx30GvQ7ppFMbais6yJRPh:3qbCR58b0lFwPD+8th57ppOaV64zAL
TLSH
T1C2168C06BCE005F9C0AAA33289B396963B75BC140F3263DB2F50B6782E72BD19D75715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2288	psexec.exe
5672	PSEXESVC.exe
608	PSEXESVC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	psexec.exe
File opened for modification	C:\Windows\PSEXEC-FRPTRMXS-F623233F.key	PSEXESVC.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	psexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	whoami.exe
Token: SeTcbPrivilege	5672	PSEXESVC.exe
Token: SeDebugPrivilege	3556	whoami.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 2352	700	funnything.exe	90
PID 700 wrote to memory of 2288	700	funnything.exe	91
PID 5672 wrote to memory of 824	5672	PSEXESVC.exe	95
PID 824 wrote to memory of 3556	824	funnything.exe	97

C:\Users\Admin\AppData\Local\Temp\funnything.exe
"C:\Users\Admin\AppData\Local\Temp\funnything.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\system32\whoami.exe
  whoami
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\psexec.exe
  C:\Users\Admin\AppData\Local\Temp\psexec.exe -accepteula -s -i C:\Users\Admin\AppData\Local\Temp\funnything.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2288

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Temp\funnything.exe
  "C:\Users\Admin\AppData\Local\Temp\funnything.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3556

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

psexec.exe

Path C:\Users\Admin\AppData\Local\Temp\psexec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXEC-FRPTRMXS-F623233F.key

Path C:\Windows\PSEXEC-FRPTRMXS-F623233F.key
Size 16B
SHA256 fedc451ccf82123398f5c3c4fff2ce0844de641d27c76882c72075b8ef4df839
MD5 0107a2d2e29127813a7d5e1df1d819e5
SHA1 c0607e3e8305e5b95f98b5419caea988053dfeda
SHA512 90c702605197924b84fdf5c0255d0217738bfabd9b746af7b7c2ead985df12dd802b1035c710f96582df865f83ddfe49f4ac9a9ee526572ad3e8f7ba656ae777
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads