ffbdd16baeaa55204bd519a485baef8e6c040cb5ef7da859668d4837cd5d8e0d

Analysis

max time kernel
299s
max time network
313s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hinge.exe
Size 172.1MB
Sample260803-pe99ssan71
SHA256 ffbdd16baeaa55204bd519a485baef8e6c040cb5ef7da859668d4837cd5d8e0d
MD5 5a222cf93b152dbde3e7adfa4c499b23
SHA1 223eaa38ff0f999eef5666892b266d9f1a963ed0
SHA512 83be7b6067600a8cbb8318c094e73b37d5eb1cd0cc3e5a5416bbbe8629719f85998e733cc7f8a91152022593dfbd0e85d0095b85565e96bb14ef387688627dcd
SSDEEP 1572864:yasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:64fc/M+i6xCL
TLSH
T182889C03E29A51D9E01DE1B5978B9233EE71BC454B28B2DF265417522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4652	javaw.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5096	1072	Hinge.exe	78
PID 1072 wrote to memory of 5096	1072	Hinge.exe	78
PID 1072 wrote to memory of 4652	1072	Hinge.exe	79

C:\Users\Admin\AppData\Local\Temp\Hinge.exe
"C:\Users\Admin\AppData\Local\Temp\Hinge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\Hinge.exe
  "C:\Users\Admin\AppData\Local\Temp\Hinge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Hinge" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1676,i,4781888607839899094,7699551959791764454,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
  2⤵
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\00710bb13af4.jar V ira-f152d4ee::default
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna13610283760981709202.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna13610283760981709202.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download