80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6

Analysis

max time kernel
148s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe
Size 830KB
Sample260821-sysqmsgn3w
SHA256 80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6
MD5 bf0f2394537d77b71717d0df5a6658b4
SHA1 09b7bf096dd612bed00212b50f647590ec4d82b4
SHA512 e98c6c63cdc362fbafa46de5f7393b9b127dced2951a1fd338a73ba95fb8e1258950958233043071b5c84e2cde39bfd3643c3605c0ed0d204dded9798bb40667
SSDEEP 24576:Y4Jupg1zPKXkk3d5PNd3h5IqYaRXB6QwUyYvmAecrXwz1pWvgxh:YG5Fb
TLSH
T17D052B237121C493C0612FF552A616347CF88B1D2D79A463AFD8BEA6BCB4533CB2691D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\80AA95E378BB03A6116EDA6EBE463697AB6858EFB91A17CA37CDF55D9EA353F6.EXE	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\80AA95E378BB03A6116EDA6EBE463697AB6858EFB91A17CA37CDF55D9EA353F6.EXE	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\LanguageConfiguration	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	796	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe
Token: SeRestorePrivilege	796	80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe

C:\Users\Admin\AppData\Local\Temp\80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe
"C:\Users\Admin\AppData\Local\Temp\80aa95e378bb03a6116eda6ebe463697ab6858efb91a17ca37cdf55d9ea353f6.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/796-1-0x000000006F930000-0x000000006F940000-memory.dmp

Download

memory/796-2-0x0000000000B20000-0x0000000000B2A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads