ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
Size 3.1MB
Sample260814-psy4pabn2s
SHA256 ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b
MD5 6410db8054feb3e5a0d43f3be57e62d5
SHA1 3ea77751b3fc4877d6d5a253085c312acca1257d
SHA512 d8b3cee24baa6d79575bec2192fd863a5743b29b37da10f6638ebcf74646d345f5abc238cda64769560666cce40aa0b94afc8254ef62863a2a58e4bad910852c
SSDEEP 98304:Hjj83OB8bAVzN0NYIRmEMRgbZD+V/zpPS0l:Hj43YXIIT/
TLSH
T181E50293BA0A8C82D83257FD1422D8BA13533EA86975D35B58F8FE37FAB31831D45581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MY\ImagePath = "\\??\\C:\\MY.sys"	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe

Executes dropped EXE 2 IoCs

pid	Process
5312	XB.exe
2940	XB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1380	cmd.exe
2952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2952	cmd.exe
5128	PING.EXE
1380	cmd.exe
4264	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Root\Certificates\A078312135472860BD6E2D448990E550BA1EA5A1\Blob = 190000000100000010000000b524e0a568a8d4839275b47313bbdb290f0000000100000030000000cf02c783ca0cf119a4ae9a29ef23fa0bf019f2bb6ef8f9f082de5a8fb2239803bde80cc564c438b380cdbe1422e9e2b4030000000100000014000000a078312135472860bd6e2d448990e550ba1ea5a1140000000100000014000000670ffc4225eefc5ea8daadc41f3097db32bfc683200000000100000098050000308205943082037ca003020102020855e5867476408fb8300d06092a864886f70d01010c05003068310b300906035504061302555331163014060355040a130d446967694365727420496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3236303631383134313130315a170d3436303631383134313130315a3068310b300906035504061302555331163014060355040a130d446967694365727420496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100cfa9592259de720685563ec3946bac5d360bd1786c22d7138fc1dcd55a7f47899e2cb2782da72540a5f561b8dd35e0e2a92eb589ecc7c7a4cbaa16d120eec4793bc9a8df217f306fcfb8d66cd2d27888cf577b796e372de6a500f45ed0f3f60c21f5df6a5e9ebd79a4008b502dec2ed7b73751c4c1495fc7c83e1273f68cd82046f857eb2581e374c070675557beaa1ad2f63516b6824ebb2a71108b1df8e1132462afdfdbe08454104016078cc9b7e2beccaa8fc440622776cd834a748c9225b9c62687be3f2b733448ada12e4885ab635e0c3adaa2af609cb194169ccb40f74d4902993472f20c9ba31b36bfb517e5615409c199784d911ab99abd718de26c11f8d1cb9591b9eef241f76c97e9a8a94a41e602b1f6f2b99921e46abbd6d891a86193119eeb90f355ce521806114c5fb1d01eb8141e50be82167ede522e537e194aea0416c13379a0f97de5da436c2e8e92024cf686fba53a51df3aba4c96e9cb3d73e725105a6f111df01792596a1d4cfb7fc84c95bfaee698ee80d4782a4f14c91921d0c1dfb06860110e29da84d011f6bbfb78455d5682ea07f2e345e85b92de2e88b2b6d84932422317f3f4ef2161e9422e01d49bce87ae371d5b7e2945a3e2d8e582fc73612134e441717abcdb81eb21ae7267b2b17193669d0d22fb01a9ddcbf521e221bf847f59e7bd72dc3bed012a47149bb2e063b5aa079dc03c910203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414670ffc4225eefc5ea8daadc41f3097db32bfc683300d06092a864886f70d01010c05000382020100be736085abb185ba747d45accce5a74862806b5845a10edac598e4fde753d2d8c7d67db607305cd65e7150de300eaeb7c47aa493fc43f3279cfb3ebfb1291d1486c6d67503e93bae8e9b9f411de20d19a7c7d701daa815289e18f8dc0e918c71810cc398f4f0cbe51c3e7d64995a9b167930a1b3806cf9f24151fad1f2e5f9660ab2023c6cfc65d828d2cabbae67d620421410fc1b696a9a285835dadc8c39b35d284f3d1346eca931d5c2101b2f3716009084b5d3ba37aa94394e7b6fc67c1e146f545c94c8816fbf7e50a57fa759aaf30e433e3e87dffa51b6a172ab28984c7268d12822f1bfec24498d5e7b739b5d4f72ac3dc8b486560b62c80f9519fe33f72de2ce13651f4ba2c69363aeafd5ffd584ba87f77d6c09c4c4e89767ece983dcb39a7ca88be3df7910c9687d3b9c1c5232aa7023fc9c2209a76812631c8f0339f6fdc2ffe8e51fafc49369556632a5affc7281bf0bbda018b2b41715a35bd98d408f76d518816f5cdbe23687c3f035a227c0e25a632e3abb1119fdf4f7d2d9d58c90207a4b901fa47ead345a0d357b2a9a84e8071c7a636afcd45d8bde1bfc31d837321def87bebe757f14e371a61aff6f5a06225aee259c2c75c68899a87224cffa3f57d3007f4096f9cdc73244b92317975b2c938f381083f65de900a2a0aa6e80760ae6f7c28344ceaccbe759204a2fc544d7ecdb3e20cb5ea04710dea4	XB.exe
Key deleted	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Root\Certificates\A078312135472860BD6E2D448990E550BA1EA5A1	XB.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Root\Certificates\A078312135472860BD6E2D448990E550BA1EA5A1\Blob = 190000000100000010000000b524e0a568a8d4839275b47313bbdb290f0000000100000030000000cf02c783ca0cf119a4ae9a29ef23fa0bf019f2bb6ef8f9f082de5a8fb2239803bde80cc564c438b380cdbe1422e9e2b4030000000100000014000000a078312135472860bd6e2d448990e550ba1ea5a1140000000100000014000000670ffc4225eefc5ea8daadc41f3097db32bfc683200000000100000098050000308205943082037ca003020102020855e5867476408fb8300d06092a864886f70d01010c05003068310b300906035504061302555331163014060355040a130d446967694365727420496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3236303631383134313130315a170d3436303631383134313130315a3068310b300906035504061302555331163014060355040a130d446967694365727420496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100cfa9592259de720685563ec3946bac5d360bd1786c22d7138fc1dcd55a7f47899e2cb2782da72540a5f561b8dd35e0e2a92eb589ecc7c7a4cbaa16d120eec4793bc9a8df217f306fcfb8d66cd2d27888cf577b796e372de6a500f45ed0f3f60c21f5df6a5e9ebd79a4008b502dec2ed7b73751c4c1495fc7c83e1273f68cd82046f857eb2581e374c070675557beaa1ad2f63516b6824ebb2a71108b1df8e1132462afdfdbe08454104016078cc9b7e2beccaa8fc440622776cd834a748c9225b9c62687be3f2b733448ada12e4885ab635e0c3adaa2af609cb194169ccb40f74d4902993472f20c9ba31b36bfb517e5615409c199784d911ab99abd718de26c11f8d1cb9591b9eef241f76c97e9a8a94a41e602b1f6f2b99921e46abbd6d891a86193119eeb90f355ce521806114c5fb1d01eb8141e50be82167ede522e537e194aea0416c13379a0f97de5da436c2e8e92024cf686fba53a51df3aba4c96e9cb3d73e725105a6f111df01792596a1d4cfb7fc84c95bfaee698ee80d4782a4f14c91921d0c1dfb06860110e29da84d011f6bbfb78455d5682ea07f2e345e85b92de2e88b2b6d84932422317f3f4ef2161e9422e01d49bce87ae371d5b7e2945a3e2d8e582fc73612134e441717abcdb81eb21ae7267b2b17193669d0d22fb01a9ddcbf521e221bf847f59e7bd72dc3bed012a47149bb2e063b5aa079dc03c910203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414670ffc4225eefc5ea8daadc41f3097db32bfc683300d06092a864886f70d01010c05000382020100be736085abb185ba747d45accce5a74862806b5845a10edac598e4fde753d2d8c7d67db607305cd65e7150de300eaeb7c47aa493fc43f3279cfb3ebfb1291d1486c6d67503e93bae8e9b9f411de20d19a7c7d701daa815289e18f8dc0e918c71810cc398f4f0cbe51c3e7d64995a9b167930a1b3806cf9f24151fad1f2e5f9660ab2023c6cfc65d828d2cabbae67d620421410fc1b696a9a285835dadc8c39b35d284f3d1346eca931d5c2101b2f3716009084b5d3ba37aa94394e7b6fc67c1e146f545c94c8816fbf7e50a57fa759aaf30e433e3e87dffa51b6a172ab28984c7268d12822f1bfec24498d5e7b739b5d4f72ac3dc8b486560b62c80f9519fe33f72de2ce13651f4ba2c69363aeafd5ffd584ba87f77d6c09c4c4e89767ece983dcb39a7ca88be3df7910c9687d3b9c1c5232aa7023fc9c2209a76812631c8f0339f6fdc2ffe8e51fafc49369556632a5affc7281bf0bbda018b2b41715a35bd98d408f76d518816f5cdbe23687c3f035a227c0e25a632e3abb1119fdf4f7d2d9d58c90207a4b901fa47ead345a0d357b2a9a84e8071c7a636afcd45d8bde1bfc31d837321def87bebe757f14e371a61aff6f5a06225aee259c2c75c68899a87224cffa3f57d3007f4096f9cdc73244b92317975b2c938f381083f65de900a2a0aa6e80760ae6f7c28344ceaccbe759204a2fc544d7ecdb3e20cb5ea04710dea4	XB.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Root\Certificates\A078312135472860BD6E2D448990E550BA1EA5A1	XB.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4264	PING.EXE
5128	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
Token: 33	4480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4480	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
2324	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 5312	4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe	89
PID 5312 wrote to memory of 1380	5312	XB.exe	90
PID 1380 wrote to memory of 4264	1380	cmd.exe	92
PID 4556 wrote to memory of 2940	4556	ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe	93
PID 2940 wrote to memory of 2952	2940	XB.exe	94
PID 2952 wrote to memory of 5128	2952	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe
"C:\Users\Admin\AppData\Local\Temp\ff2174159f1a3b72f31a8bc91f727ff0cc265aa111ad12de2026f5fb61cf427b.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\XB.exe
  C:\Users\Admin\AppData\Local\Temp\XB.exe
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\XB.exe"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4264
- C:\Users\Admin\AppData\Local\Temp\XB.exe
  C:\Users\Admin\AppData\Local\Temp\XB.exe
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\XB.exe"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2324

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XB.exe

Path C:\Users\Admin\AppData\Local\Temp\XB.exe
Size 26KB
SHA256 733461b08d814efc0551e7786fde159ea6f4c5a29c1d807a5cbb2a53b4b0e9ea
MD5 9ae9e587e9b1dd20584a1f36ee2c02cd
SHA1 2e4560c8ab18b308cebb551f2045c1a3b4692901
SHA512 b23223c98867faad28c8e0c5c3b381f8f5a721c36ba3b04c043fb2ceb531e56acef77520ec96fbaccd5beb3ff622f2d9460256102cecb6b0e14ccd0984bbb6fa
SSDEEP 768:YT+haYsI9YzyPGv37cyPGM1+iDwmoLk5L6:XaYsI9o6GP7c6GIzDwg6
TLSH
T19CC2D82039EA801DF573AF745FD4B56ADE6FF3632A0665A9209003474B13F41DE95278
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2324-26-0x00000170A6C10000-0x00000170A6E6F000-memory.dmp

Download

memory/4556-21-0x0000000000400000-0x0000000000CC1000-memory.dmp

Download

memory/4556-2-0x0000000010000000-0x0000000010217000-memory.dmp

Download

memory/4556-17-0x0000000000400000-0x0000000000CC1000-memory.dmp

Download

memory/4556-1-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/4556-24-0x0000000000400000-0x0000000000CC1000-memory.dmp

Download

memory/4556-25-0x0000000000400000-0x0000000000CC1000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x0000000000CC1000-memory.dmp

Download

memory/5312-13-0x00007FFC3D47F000-0x00007FFC3D480000-memory.dmp

Download

memory/5312-14-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

Download

memory/5312-16-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/5312-18-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download