Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 06:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Trojan.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Trojan.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Trojan.exe
- Size 436KB
- Sample260809-g3294asckh
- SHA256 905bd32f12c97b36002436055a332c658500f0f534952165a6a9626be9d934e2
- MD5 9b445bbb063ffe59028adf5536f415b1
- SHA1 3bfd21e011375ffd1c80c01a79d806c35755270b
- SHA512 92f2879e428f01987633a72a9c639b62450b70a9454033e628a97ea8c983c97974ca6379c7b60768a94f0fe99ab7d6475d63abbb2cc5d9d9c4920cc0f77df4c5
- SSDEEP 12288:7MSU4joci8M6PW1GVFeFd60DFUyhe3YM:ASUCpM2W1Gvgmye3v
- TLSH T171947D27F6D08437D16336B9DC1B9698A929BD505D24244A3BF83E4C4F39383F92629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe" Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe" Trojan.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe" Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe" Trojan.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 4816 Trojan.exe 1112 Trojan.exe 4816 Trojan.exe 1112 Trojan.exe 4816 Trojan.exe 1112 Trojan.exe 4816 Trojan.exe 1112 Trojan.exe 4816 Trojan.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1112 2004 userinit.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4816
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1112
-