db427057243f10ad9a20e4aacc863e85c66eb62fa30c952adae2b6fa7f1124f3

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
взрыв.exe
Size 2.0MB
Sample260802-v6e6matya1
SHA256 db427057243f10ad9a20e4aacc863e85c66eb62fa30c952adae2b6fa7f1124f3
MD5 89f7085f45fba194b4e36ad10c25f67b
SHA1 ba8aa3a2e007a2cf8ce8ff2efcdbe46d802447ae
SHA512 18b127c10b95f40d73f6af054a2f90f3f40084bdb2519bc461bf64e4383cce3fded9ee48510557ece2f8bb59b9f246750ca4fd4c456e6095a33ffb7457852bcf
SSDEEP 49152:Qr3Ji42WKQdQr8h9eIuuT85pQvyARLEWInfEXWpRQIOq3HJ:QrZiUjuk9eldwRL5UZRmq5
TLSH
T19495F162E8B3851AF3C7E676C7B22A48CCE0B584E794552F30A4AF0566D33C471DB297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4272	wscript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4272	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	взрыв.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	428	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	428	AUDIODG.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4272	3444	взрыв.exe	82

C:\Users\Admin\AppData\Local\Temp\взрыв.exe
"C:\Users\Admin\AppData\Local\Temp\взрыв.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\d_240658609.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d_240658609.vbs

Path C:\Users\Admin\AppData\Local\Temp\d_240658609.vbs
Size 289B
SHA256 5cc811ff8777101ea00683a22d276145108f0057cba5762eea060199dd69c22b
MD5 d9cbd3fa46fa6cc8a0250f293590f9e9
SHA1 e138ccfc51ec1b1e9294bd7f2ed2bf50bde519fd
SHA512 0c7adcc4c905b6285aa2dcecd4bed50898f29c8f1bc13d64c9435d6beb322fd58387f900a45f2e15b4f91e269e74a4c78a8191ff8935a96bda0b542d1c36756f
TLSH
T1A2D0EB00AF16C67C003200830CB3C84FC19804385AC0DB10B880CD497343E396D9A893
MD5 SHA1 SHA512 TLSH

Submit Download