449438b41b213155444d0da11c270dea561322d89d06b181a8ad09a86da81bd8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
madcausebad cracked by tank230.exe
Size 3.8MB
Sample260807-zyvcsscn4t
SHA256 449438b41b213155444d0da11c270dea561322d89d06b181a8ad09a86da81bd8
MD5 0c6ada7da5c25a7b346b407d58730f75
SHA1 0c0b0033c9c7166c3d0eb09c0ec3abc74419f2f3
SHA512 a539c4de7745859aba002a2ccece46199fcdabfd26c7f06e408bc1d85f34811f60bc3fb8d4140066cebee17332f2b8d0b191918374c9f78c04868af8c7c79fb8
SSDEEP 49152:oXwV0MMbHgy4I9YnDvuHJZgkD0P4fITbl9nfq9smbYlo:aUBvIJ/Dy2IT5tbmbYl
TLSH
T17E06E046636EC1E8D92A813C54B66BC7B6F13D3DD3108FEF22D04CA81E9B6D15AB56C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	madcausebad cracked by tank230.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	madcausebad cracked by tank230.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	madcausebad cracked by tank230.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	madcausebad cracked by tank230.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5184	madcausebad cracked by tank230.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5184	madcausebad cracked by tank230.exe

C:\Users\Admin\AppData\Local\Temp\madcausebad cracked by tank230.exe
"C:\Users\Admin\AppData\Local\Temp\madcausebad cracked by tank230.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads