c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Size 1.4MB
Sample260804-a7f44aej3x
SHA256 c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca
MD5 8a63182abf4429ebdf8d3a34bc979f38
SHA1 1e0576e49a31b034ffccd230e2737ffc877ab7fb
SHA512 545c276183d05151422100aebbd3711053f1b5c1c468659d9ac6d8c51196a03b312f4cad0c37d819d7df0b1f5f6b9693d0a707542e42ece13b78c570b64b3fde
SSDEEP 24576:6yiMB9GSr5IptOJqbZ3kw4Ii8wd0uiclmZeXZxTfiE6uIFkB6tbQE9H:V9cKDz8wdRiMmGTALkEtl9
TLSH
T12F6533B3A1F25571E0B3D1B9946519547FB647028E28A79AF21C7B0CCA39CFA77206C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4612	sg.tmp
2820	driver.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe\""	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\driver.exe = "\"C:\\ProgramData\\~6468207688891409375\\driver.exe\""	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeBackupPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeRestorePrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: 33	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeCreateGlobalPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: 33	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: 33	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeBackupPrivilege	5464	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeRestorePrivilege	5464	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: 33	5464	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	5464	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: 33	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeRestorePrivilege	4612	sg.tmp
Token: 35	4612	sg.tmp
Token: SeSecurityPrivilege	4612	sg.tmp
Token: SeSecurityPrivilege	4612	sg.tmp
Token: 33	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeBackupPrivilege	5108	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeRestorePrivilege	5108	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: 33	5108	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeIncBasePriorityPrivilege	5108	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
Token: SeCreateGlobalPrivilege	5108	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4760	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe	89
PID 2868 wrote to memory of 5464	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe	91
PID 2868 wrote to memory of 4612	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe	92
PID 2868 wrote to memory of 2820	2868	c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe	96

C:\Users\Admin\AppData\Local\Temp\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
"C:\Users\Admin\AppData\Local\Temp\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1018368 -len=410639 "C:\Users\Admin\AppData\Local\Temp\~7218344314217740462.tmp",,C:\Users\Admin\AppData\Local\Temp\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5464
- C:\Users\Admin\AppData\Local\Temp\~4815259891855361024~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~7218344314217740462.tmp" -y -aos -o"C:\ProgramData\~6468207688891409375"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\ProgramData\~6468207688891409375\driver.exe
  "C:\ProgramData\~6468207688891409375\driver.exe"
  2⤵
  - Executes dropped EXE
  PID:2820

C:\Users\Admin\AppData\Local\Temp\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe
"C:\Users\Admin\AppData\Local\Temp\c99f4c95c7dcd8fcdc1bbc892eff082c3ba3b1826858566afc095776737028ca.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

driver.exe

Path C:\ProgramData\~6468207688891409375\driver.exe
Size 444KB
SHA256 eb19f2cfe47395017288015c4efe69def2c8f26651db3fdb18990a71ce9879a9
MD5 7c52e74fd1387a6635dbc94230a1e18b
SHA1 64d950207b0189362c5c9c71c6a9230938395a7f
SHA512 357608f3a0e17c89de1ebb9bd8cd6ef7e0f388796b689c67354b1ecf18c2e6222093fbaaf6ae99ee043dcc3e2cc91b703966eeb11f7ccf3e78826bf9beb94693
SSDEEP 12288:kUVVrO4ET4BTwBz78tsi50Zj54qDxHzlPuRfkf:kick+YtbazZ26
TLSH
T180A4022AE3F210F5C04E823686E757A3E473BC311626769F1388EB753F948D27729A54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~4815259891855361024~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
TLSH
T131F49E223BF6C1BBD24201318A1CABF590F5F7590B3059C363908F6D6B399D5D63AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~7218344314217740462.tmp

Path C:\Users\Admin\AppData\Local\Temp\~7218344314217740462.tmp
Size 401KB
SHA256 d5f5d8c97b2af24f4af317f0d86142b4f49167b43cf74abe667577ce8e1fcecf
MD5 9396c1d8430a4d20a094cb023f122ba9
SHA1 4e866466f527b7f5c64c98a872b71fa629ca5705
SHA512 57035d4c105fef67473a317729d6fc7c3ab98dad79ee36740a617532b3b1d911530c4b8272744455135cd4678daf488399d41f953d5dcae86719a6e0f2b7a8fe
SSDEEP 6144:7Cc4yAlPwHiZT4BDTHAEqr6v79P9B4VNYk3LO0siD/L0Zj5WRqOCGQMTzznhxomQ:2LR4ET4BTHBz7+tsiv0Zj54qD2HzhxdU
TLSH
T1E3942397E4BF9A72E3624773C6AB590337B34E130E257391F198ED6654424EF3E20889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2820-25-0x0000015F59AE0000-0x0000015F59BD0000-memory.dmp

Download

memory/2820-28-0x00007FF6F4210000-0x00007FF6F4287000-memory.dmp

Download

memory/2820-55-0x00007FF6F4210000-0x00007FF6F4287000-memory.dmp

Download

memory/2868-0-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2868-26-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5108-24-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5464-8-0x0000000000400000-0x000000000055A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads