0794022a72a69256b2c93df157c77f0daff33bba46adf3e7b2c7d2e14ee4ef49

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.html.exe
Size 51KB
Sample260820-plrq2ack3y
SHA256 0794022a72a69256b2c93df157c77f0daff33bba46adf3e7b2c7d2e14ee4ef49
MD5 e47748c361f6827bc6b8d8dc8efdb83b
SHA1 06849dfd4c926104b78c4f8890cca0445f85bb96
SHA512 aa687046a303f57a6b2d919f698c35f91c2bc04c4c17e5ed8c99b3cf0106d551e84c1a9f49c35a392282d304c1ce0f6834e992a314346b0f582536bea2813cfd
SSDEEP 768:EmQZqx1lYcTYbFGLbiFIhWYJZJ4fof6qTkYeBwbeP+XbYC1261:E0lY8VhWqZJ4fof6qTkYEHybL1
TLSH
T1253318186F48D22EC5BECE3DA8924542CA32122B2012DB453D8D51DDAFB7749C67DB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2820	index.html.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	index.html.exe
Token: SeIncreaseQuotaPrivilege	2820	index.html.exe
Token: SeSecurityPrivilege	2820	index.html.exe
Token: SeTakeOwnershipPrivilege	2820	index.html.exe
Token: SeLoadDriverPrivilege	2820	index.html.exe
Token: SeSystemProfilePrivilege	2820	index.html.exe
Token: SeSystemtimePrivilege	2820	index.html.exe
Token: SeProfSingleProcessPrivilege	2820	index.html.exe
Token: SeIncBasePriorityPrivilege	2820	index.html.exe
Token: SeCreatePagefilePrivilege	2820	index.html.exe
Token: SeBackupPrivilege	2820	index.html.exe
Token: SeRestorePrivilege	2820	index.html.exe
Token: SeShutdownPrivilege	2820	index.html.exe
Token: SeDebugPrivilege	2820	index.html.exe
Token: SeSystemEnvironmentPrivilege	2820	index.html.exe
Token: SeRemoteShutdownPrivilege	2820	index.html.exe
Token: SeUndockPrivilege	2820	index.html.exe
Token: SeManageVolumePrivilege	2820	index.html.exe
Token: 33	2820	index.html.exe
Token: 34	2820	index.html.exe
Token: 35	2820	index.html.exe
Token: 36	2820	index.html.exe
Token: SeIncreaseQuotaPrivilege	2820	index.html.exe
Token: SeSecurityPrivilege	2820	index.html.exe
Token: SeTakeOwnershipPrivilege	2820	index.html.exe
Token: SeLoadDriverPrivilege	2820	index.html.exe
Token: SeSystemProfilePrivilege	2820	index.html.exe
Token: SeSystemtimePrivilege	2820	index.html.exe
Token: SeProfSingleProcessPrivilege	2820	index.html.exe
Token: SeIncBasePriorityPrivilege	2820	index.html.exe
Token: SeCreatePagefilePrivilege	2820	index.html.exe
Token: SeBackupPrivilege	2820	index.html.exe
Token: SeRestorePrivilege	2820	index.html.exe
Token: SeShutdownPrivilege	2820	index.html.exe
Token: SeDebugPrivilege	2820	index.html.exe
Token: SeSystemEnvironmentPrivilege	2820	index.html.exe
Token: SeRemoteShutdownPrivilege	2820	index.html.exe
Token: SeUndockPrivilege	2820	index.html.exe
Token: SeManageVolumePrivilege	2820	index.html.exe
Token: 33	2820	index.html.exe
Token: 34	2820	index.html.exe
Token: 35	2820	index.html.exe
Token: 36	2820	index.html.exe
Token: SeIncreaseQuotaPrivilege	2820	index.html.exe
Token: SeSecurityPrivilege	2820	index.html.exe
Token: SeTakeOwnershipPrivilege	2820	index.html.exe
Token: SeLoadDriverPrivilege	2820	index.html.exe
Token: SeSystemProfilePrivilege	2820	index.html.exe
Token: SeSystemtimePrivilege	2820	index.html.exe
Token: SeProfSingleProcessPrivilege	2820	index.html.exe
Token: SeIncBasePriorityPrivilege	2820	index.html.exe
Token: SeCreatePagefilePrivilege	2820	index.html.exe
Token: SeBackupPrivilege	2820	index.html.exe
Token: SeRestorePrivilege	2820	index.html.exe
Token: SeShutdownPrivilege	2820	index.html.exe
Token: SeDebugPrivilege	2820	index.html.exe
Token: SeSystemEnvironmentPrivilege	2820	index.html.exe
Token: SeRemoteShutdownPrivilege	2820	index.html.exe
Token: SeUndockPrivilege	2820	index.html.exe
Token: SeManageVolumePrivilege	2820	index.html.exe
Token: 33	2820	index.html.exe
Token: 34	2820	index.html.exe
Token: 35	2820	index.html.exe
Token: 36	2820	index.html.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2916	2820	index.html.exe	89
PID 2916 wrote to memory of 3276	2916	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\index.html.exe
"C:\Users\Admin\AppData\Local\Temp\index.html.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4tntsdgm\4tntsdgm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30AB.tmp" "c:\Users\Admin\AppData\Local\Temp\4tntsdgm\CSC8570F0B2B574D098E212BFCA7ABE8EC.TMP"
    3⤵
    PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4tntsdgm.dll

Path C:\Users\Admin\AppData\Local\Temp\4tntsdgm\4tntsdgm.dll
Size 3KB
SHA256 10f596414473e3ef7c7bcb6a6f1a310dc67a8129e6343b3d50a08ee025eee40b
MD5 e9348b1be8673018dbd74e6a30b1e319
SHA1 1ef15de5f701367e6a31ee8aa5e1c0fb3d739685
SHA512 7ac4ea71d970b8c537b957423a75ca301ca02f14c98ef8a44106df8a6fcfd039b6e286a3d4e17b6dad74b193eed4fd16309d08e6287d7e9cfd36b39527a8c643
TLSH
T15E51AA0AA3E9066BE4B70B316EF3431637A4F8109F72A76D59C042696C657185D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES30AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES30AB.tmp
Size 1KB
SHA256 3df1912ff3621f1cf4ae9cbd01e9feada43ec8cf9ef44fad5a0e28fe8185c90a
MD5 678e6e3d101cb58ad27840c971e7a04a
SHA1 5fcd57f6c349c5f554ab2f1619355c1d3c1369b2
SHA512 8aaf94eb2361e43c86a49d2d1e9352c33bcf37ad576e067ad64f74ce05c322a7c77d9f8002f554c3861ea42715a36c92ba844b104a362bd404ff146243dd6342
TLSH
T1F921CC0593E9470FF0734B3169F6532F9274FD55AFA2A75A8980422C2C51504EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

4tntsdgm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4tntsdgm\4tntsdgm.0.cs
Size 192B
SHA256 a38504c00ed2cc32c751be7a01e031d030d7524ccaf88255f7be74c4b190f976
MD5 e7fc667eb07072ec0bb97197992bbd4d
SHA1 a7f1d27e177c0ce69137087aeca5ed3e45b5018d
SHA512 89b42965bd7d8b95c79d13879f4f132175f3b5cfc02ed45aaaef0e30e166e102675bea2153d59ad433d8fea84e9fcc59dd646fc2605d3ea0d96ea0bca9f0821b
TLSH
T186C0801C524FBE25C47304175D00D4D9F7DB1566577B7500B9DC42028F774556135E3D
MD5 SHA1 SHA512 TLSH

Submit Download

4tntsdgm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4tntsdgm\4tntsdgm.cmdline
Size 369B
SHA256 3398577951e3f5ccc2529cb55e1a89933d73f40fff2b3a93461b5d708943a067
MD5 1d7332551337d2e9d18aadb081c377a5
SHA1 3e1bd0a74e98fdff73cd953f527f45902022e358
SHA512 01bd515d0fb75bbff83506feb8729f66a4958a65f17228babf477d7e67701c19d93478b4902b41b70003b94a0da0186f6702de6e0a4817a84b274aeccb6f15c4
TLSH
T1D9E06F3A6246CABE21FD184B327AC4EC837207833A813F84E080C68EE02B4002BD3781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8570F0B2B574D098E212BFCA7ABE8EC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4tntsdgm\CSC8570F0B2B574D098E212BFCA7ABE8EC.TMP
Size 652B
SHA256 cc61e3f90bc877e2e122791f33cfb91cf9c8a5028ee282f2bb712410569f3873
MD5 5c98cc3d80b69c4f6bdb036c4602be0d
SHA1 27ccd96528ebda6af87e97146c9cb6a3f58e0141
SHA512 2c3f9252d5ca0e5f3c3449a530cb48a1da24ed6a693101b9a66db63bb8ca2b47ead2e711e281d1832bc7603762a4a78d8df3c216509a35ec0cd477746f3978a8
TLSH
T118F03A4963F8020EF0F34B30B9F6836791A8BC65DE3293ED1990031D2C64A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2820-27-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-34-0x000000001D460000-0x000000001D46A000-memory.dmp

Download

memory/2820-6-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-11-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-5-0x000000001B310000-0x000000001B332000-memory.dmp

Download

memory/2820-21-0x0000000002720000-0x0000000002728000-memory.dmp

Download

memory/2820-4-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-1-0x0000000000600000-0x0000000000614000-memory.dmp

Download

memory/2820-22-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-23-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-24-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-25-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-26-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-0-0x00007FFE519BF000-0x00007FFE519C0000-memory.dmp

Download

memory/2820-28-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-29-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-33-0x0000000023560000-0x0000000023612000-memory.dmp

Download

memory/2820-10-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-35-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-32-0x000000001D880000-0x000000001D89E000-memory.dmp

Download

memory/2820-36-0x0000000023660000-0x000000002367E000-memory.dmp

Download

memory/2820-37-0x0000000023680000-0x000000002368A000-memory.dmp

Download

memory/2820-38-0x0000000023690000-0x000000002369A000-memory.dmp

Download

memory/2820-40-0x0000000023590000-0x00000000235B4000-memory.dmp

Download

memory/2820-39-0x0000000023590000-0x00000000235BA000-memory.dmp

Download

memory/2820-41-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-42-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-43-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-44-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-45-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-46-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-48-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2820-49-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download