Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe
- Size 686KB
- Sample260805-bcjgeabc82
- SHA256 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8
- MD5 58d8be0d8c21f8c8edb5b5fa94656554
- SHA1 c5f1db2631e2629d9c49e1ad4adcfe163262b1be
- SHA512 1d5bc1cc7535204afabaf36cacdc6cbfd6355d5654efdbda18c640ff28c5a92ee87468901cf23c89cf72302abc9b6058effb043b55c16ff4ef72efd6d8f138f5
- SSDEEP 12288:1Cn5HbrEE7thWF8XTUrm0Zlrcj/uu4fJzov3um58/:U57rEE7t8YUrm0Z9kmu4p66
- TLSH T193E48D5A7BA441F9D167D13ACD528946F7B278061B319BDF03A043AB2F276E04E3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5460 wmic.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5460 wmic.exe 5460 wmic.exe 5460 wmic.exe 5460 wmic.exe 1492 wmic.exe 1492 wmic.exe 1492 wmic.exe 1492 wmic.exe 1980 wmic.exe 1980 wmic.exe 1980 wmic.exe 1980 wmic.exe 4476 wmic.exe 4476 wmic.exe 4476 wmic.exe 4476 wmic.exe 1636 wmic.exe 1636 wmic.exe 1636 wmic.exe 1636 wmic.exe 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5460 wmic.exe Token: SeSecurityPrivilege 5460 wmic.exe Token: SeTakeOwnershipPrivilege 5460 wmic.exe Token: SeLoadDriverPrivilege 5460 wmic.exe Token: SeSystemProfilePrivilege 5460 wmic.exe Token: SeSystemtimePrivilege 5460 wmic.exe Token: SeProfSingleProcessPrivilege 5460 wmic.exe Token: SeIncBasePriorityPrivilege 5460 wmic.exe Token: SeCreatePagefilePrivilege 5460 wmic.exe Token: SeBackupPrivilege 5460 wmic.exe Token: SeRestorePrivilege 5460 wmic.exe Token: SeShutdownPrivilege 5460 wmic.exe Token: SeDebugPrivilege 5460 wmic.exe Token: SeSystemEnvironmentPrivilege 5460 wmic.exe Token: SeRemoteShutdownPrivilege 5460 wmic.exe Token: SeUndockPrivilege 5460 wmic.exe Token: SeManageVolumePrivilege 5460 wmic.exe Token: 33 5460 wmic.exe Token: 34 5460 wmic.exe Token: 35 5460 wmic.exe Token: 36 5460 wmic.exe Token: SeIncreaseQuotaPrivilege 5460 wmic.exe Token: SeSecurityPrivilege 5460 wmic.exe Token: SeTakeOwnershipPrivilege 5460 wmic.exe Token: SeLoadDriverPrivilege 5460 wmic.exe Token: SeSystemProfilePrivilege 5460 wmic.exe Token: SeSystemtimePrivilege 5460 wmic.exe Token: SeProfSingleProcessPrivilege 5460 wmic.exe Token: SeIncBasePriorityPrivilege 5460 wmic.exe Token: SeCreatePagefilePrivilege 5460 wmic.exe Token: SeBackupPrivilege 5460 wmic.exe Token: SeRestorePrivilege 5460 wmic.exe Token: SeShutdownPrivilege 5460 wmic.exe Token: SeDebugPrivilege 5460 wmic.exe Token: SeSystemEnvironmentPrivilege 5460 wmic.exe Token: SeRemoteShutdownPrivilege 5460 wmic.exe Token: SeUndockPrivilege 5460 wmic.exe Token: SeManageVolumePrivilege 5460 wmic.exe Token: 33 5460 wmic.exe Token: 34 5460 wmic.exe Token: 35 5460 wmic.exe Token: 36 5460 wmic.exe Token: SeIncreaseQuotaPrivilege 1492 wmic.exe Token: SeSecurityPrivilege 1492 wmic.exe Token: SeTakeOwnershipPrivilege 1492 wmic.exe Token: SeLoadDriverPrivilege 1492 wmic.exe Token: SeSystemProfilePrivilege 1492 wmic.exe Token: SeSystemtimePrivilege 1492 wmic.exe Token: SeProfSingleProcessPrivilege 1492 wmic.exe Token: SeIncBasePriorityPrivilege 1492 wmic.exe Token: SeCreatePagefilePrivilege 1492 wmic.exe Token: SeBackupPrivilege 1492 wmic.exe Token: SeRestorePrivilege 1492 wmic.exe Token: SeShutdownPrivilege 1492 wmic.exe Token: SeDebugPrivilege 1492 wmic.exe Token: SeSystemEnvironmentPrivilege 1492 wmic.exe Token: SeRemoteShutdownPrivilege 1492 wmic.exe Token: SeUndockPrivilege 1492 wmic.exe Token: SeManageVolumePrivilege 1492 wmic.exe Token: 33 1492 wmic.exe Token: 34 1492 wmic.exe Token: 35 1492 wmic.exe Token: 36 1492 wmic.exe Token: SeIncreaseQuotaPrivilege 1492 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3412 wrote to memory of 5460 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe 90 PID 3412 wrote to memory of 1492 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe 93 PID 3412 wrote to memory of 1980 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe 95 PID 3412 wrote to memory of 4476 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe 97 PID 3412 wrote to memory of 1636 3412 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe"C:\Users\Admin\AppData\Local\Temp\ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get serialnumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get product2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get driverversion2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636
-