8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe
Size 832KB
Sample260821-sysqmssfld
SHA256 8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8
MD5 f2d35ea6942024cf4b0defea81e2ca55
SHA1 1eac0b89af861ba57616651a3438090a6581f97f
SHA512 0e08d8048ebf63d2fa2b225b43a35620adb02eec7faac5b1b76decaec42d8a3982ef92611713778d57ec0238f3686e657b130f65fc395eefda00f38adc0dd86d
SSDEEP 24576:Ia1LDV6vuttHAK3hnWciRY7AZa7jhdX+synGXmt3TGbQzb3WvWxk:IksH3u
TLSH
T1D10529137121C0A2D1612FF566A217343CF84B192D79A963AFE8BEA6BCB4533CF2550D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\8F9B5049D9F569859057FAB163EE865D202F1E90CB14630DE56E688CA90E0EA8.EXE	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\8F9B5049D9F569859057FAB163EE865D202F1E90CB14630DE56E688CA90E0EA8.EXE	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\LanguageConfiguration	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	4888	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe
Token: SeRestorePrivilege	4888	8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe

C:\Users\Admin\AppData\Local\Temp\8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe
"C:\Users\Admin\AppData\Local\Temp\8f9b5049d9f569859057fab163ee865d202f1e90cb14630de56e688ca90e0ea8.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-0-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/4888-1-0x000000006F880000-0x000000006F890000-memory.dmp

Download

memory/4888-2-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads