522aab5133fe9e625237fac5f76c5d8bfa813c71fd67fed08e1c9d05d11f759a

Analysis

max time kernel
164s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ssn.exe
Size 596KB
Sample260813-ajdztsff28
SHA256 522aab5133fe9e625237fac5f76c5d8bfa813c71fd67fed08e1c9d05d11f759a
MD5 302b19f2e591d372d9313ff3b34fae4c
SHA1 9d22a7f024c9d243e870f6dbee39beac8653130a
SHA512 e1a5261eeb75862c02486d3fd3284a0b71ecf12eb3f4778ee422c9976ee0bb9f4ec9ea50c09924416f10fae3b823c01e474798f0266302e2041b5b3b938d48b8
SSDEEP 12288:lLiZpxyQi06NqfMa01XC3/lwwcgNK6prNp/:lIpxyQi04801XCvl5cgNxprT/
TLSH
T126D40204FBC1A5ECC9768A7449FBC6A741337D989C75A60F6148FB7F3D70A418A3920A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4700	ssn.exe
4700	ssn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4700	ssn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4700	ssn.exe
4700	ssn.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4700	ssn.exe
4700	ssn.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4700	ssn.exe
4700	ssn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3536	4700	ssn.exe	89
PID 4700 wrote to memory of 3536	4700	ssn.exe	89

C:\Users\Admin\AppData\Local\Temp\ssn.exe
"C:\Users\Admin\AppData\Local\Temp\ssn.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\ssn.exe
  "C:\Users\Admin\AppData\Local\Temp\ssn.exe"
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ball.ini

Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
Size 78B
SHA256 0f3f0d3e271167c35cdc6cc4aeac09fe98b2ad19e8f58c19e0054c7efe8256cc
MD5 967b540d4a601e345a5df14cced0e4f0
SHA1 96d1650b00849803438deb4e1cd159d3c0ad26fc
SHA512 070960d547e45a8f41d234444c2634caa434c32e91b6ea03c3af76e748401200b2521549921a64272cad611d3284221185bd20b84a10290e8084a8ba36bfe67d
TLSH
T1C3A02202AAE00000C000C3BE08828AB3B20B800BA0CF0002323C0B20C30E832820E883
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh216B.tmp\System.dll
Size 25KB
SHA256 29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438
MD5 9b3a5adad3c54468b976f683ef28aae4
SHA1 e6ce3ed9fa51474ca560c41075be8cd52ae81e46
SHA512 338ac47163f4c74af5c46318abf9d2a86febeeba4966ba2f3bcc5edc95ca373e253b3214fdcf349a13d431852b052d5910947ee9a63797ca4da0ba8333db4929
SSDEEP 384:5Z2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHG1Q:5r96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1A8B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-51-0x0000000000080000-0x000000000011E000-memory.dmp

Download

memory/3536-54-0x00007FFCEF269000-0x00007FFCEF26B000-memory.dmp

Download

memory/4700-49-0x00007FFCE3470000-0x00007FFCE347F000-memory.dmp

Download

memory/4700-48-0x00007FFCE3479000-0x00007FFCE347A000-memory.dmp

Download

memory/4700-50-0x0000000004010000-0x0000000007A78000-memory.dmp

Download

memory/4700-52-0x0000000140000000-0x0000000140126000-memory.dmp

Download