Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe
- Size 508KB
- Sample260808-wdtzrasamb
- SHA256 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70
- MD5 bd17391a769fe4e681befceef02c80a4
- SHA1 c27c8d7307b4438ffa171c70ab1941a7fe88bb59
- SHA512 8a39d4f9bedbd791eb1bac670a75864f3847e456aeaa47e6b2402863806ac823dd549f358e6d3cfc792d0fb05617e9fb47766d87ec1d99b4756f991fce9b8f10
- SSDEEP 6144:vW0J07EHxsWKKCbrZXDbI33z5P/kjguInr39tAOLPvI1ILz:O4CWKKCrZTGF/k8uMxtxPvvz
- TLSH T199B49D01FBB6C1B2C99741B40C69D71E6231BA4817354BE7FBC81F5E8E613C1AE7624A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\tkjsidfsd 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3204 wrote to memory of 5996 3204 4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe"C:\Users\Admin\AppData\Local\Temp\4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\4bf86f958656e050847092f45318e1baba675021eaa9f62c96983f141ad1bf70.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5996
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\tkjsidfsd
- Size 46B
- SHA256 fb6ecb64995ed09576437d4626c542d6d346c26c961a5195b05afd38dffc892d
- MD5 5205a86f0a7d8cc3f63754ce0b9a432a
- SHA1 169d5ca18ebc2d4094a8b0f90fa14c238fc0d08a
- SHA512 f41fde5d1918a9c0a378904d7f1e1aa4d9133422277ba97024a5f06b0fe0fea0f31cadfe9c942395338146d37e528558ac542fd163874314aaaf2db44e7ec85e
- MD5 SHA1 SHA512
- Path C:\Windows\tkjsidfsd
- Size 93B
- SHA256 188ab79e26e31e9d2b0c8080add1e8e0637a54585a701f6e18009d19dc0d77a6
- MD5 77307a1db071d9a516760dbc572268e4
- SHA1 5cc589d02e57aae613723dfb737ef141829318cf
- SHA512 752471b52081731304f53e9f234295af61199fb97f13fd5f64e54a3c691cbce4b3b27891043707af89860d86c12734295685faa78b23ac604a03b503b929159a
- TLSH T167B00103040310B82CCB8E402506CECF730ACBFB311F3632333880B078048109E3A570
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\tkjsidfsd
- Size 23B
- SHA256 e814408fdddfe57a72ddeaf5d181fa687ef103e2778754c256d70294956160b0
- MD5 3037dccdd08fda7b21eee38f29abad2a
- SHA1 7d358b5ef924809ac8a8231aaca3bc8b872003eb
- SHA512 6361d775e689358dabe4880b2912b2f115678a5643596ba2028e461acbcf15a7454d154d358b966676f15a9fcd4e4b2a150078c45b246a5fabe69fdea627166b
- MD5 SHA1 SHA512
- Path C:\Windows\tkjsidfsd
- Size 89B
- SHA256 f3f7fb770e3fc4e48c7314eff0aeb81cead1876cc4d821ac100a156bca73da20
- MD5 05c6e77adb8cd215317ea92ba375d6ab
- SHA1 de63f455a4c05453dc3c7a1b9e3e9b4999372c9f
- SHA512 0c5cc3b0ad2f7331a9f9a2bd92480b40d823929818ba2acbea170474c457da9a249d9d051eff1abb80d1de11b6c33ac04464433665fc5bd10ec1f2b03d1aa2dc
- TLSH T145B00103040300B82CCB8E402106CECF730ACBEB301B3632333880B078048109E39570
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\tkjsidfsd
- Size 116B
- SHA256 0f4a54d5f496641fbccc40fe76a31ad20d900f5cea5b0ac6f648bb3b5beaa537
- MD5 5f7e05bc0d84541a2dc56cd60604814d
- SHA1 ac8a4cf52931e5e99bde98ff3438376b49a92745
- SHA512 b007eea727b677747722a63d21c65c73f1bb3093d530771ff56f959a4493436daf7c55ba4651a50957617365c0fa640fa214e64ee54eeb30f7ab6984792a86b1
- TLSH T1A3B00913040310B82CCB8E406606CECF730BCBFB351F3632333884B478058109E3A660
- MD5 SHA1 SHA512 TLSH