Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe
- Size 10.9MB
- Sample260808-p2cxta1wet
- SHA256 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695
- MD5 157b288c2391a98c5fd0aebf8e5c4cee
- SHA1 2eabe0ce607ef5012568658d394921bdfaa67787
- SHA512 7926b8130d68de0efd355282c21f32ad0506fa6a7eab3e1bd9fce478a58fc8b8a6e1c2aca39a7d7bafd910e528746d10dbeafbfaf2d8f3b5479e6b637f6d3042
- SSDEEP 196608:kgl65O1rcYthoGay4X7dCOEAZFQB1w2pa7ju7mo9kt38Zaj/vnn8DzXhQg0ELIHR:9l65O1YYtMldDRCahsZ2HnAzighLIx
- TLSH T101B612613D22C463C9A10935CD6AEEFC64357F72DE35A16336D27FAF3A322508A66113
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 820 Process not Found - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe 5600 583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe"C:\Users\Admin\AppData\Local\Temp\583bcd6c5ab1801bfc913e091e771ddc6e65709a923c0eaf088e45cfbf4bd695.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5600