30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe
Size 718KB
Sample260821-tc6k2sshpg
SHA256 30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0
MD5 53a60ade9637f024b726b1c982cd6010
SHA1 c88476bd59b8716f5cf4a8f0d3be0299c5d022da
SHA512 af4d0daa72037444e16f9346a9af78a8ffec2da9716d9373599fefb3e0a16f33b9a28feab13be05722765e3464b447ff356d8a786fb4d715269736c8a357a0db
SSDEEP 12288:iEgJ/tMpx1PpUIHVc36i8I0ZWM4PQvCG3fBMtsfmWGAMYiejv48oSlGxiB:iEgJ/tMpx1PpUIHVc36i8I8WMXvCG3ft
TLSH
T190F43A2372118492D1212BF9969716287DF8871C2E78D823DFD8AE67BDB4632CF3650D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\gzip.dll	30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe
Token: SeDebugPrivilege	3224	30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe

C:\Users\Admin\AppData\Local\Temp\30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe
"C:\Users\Admin\AppData\Local\Temp\30df2485ba8d8263036aa57114c2b473787dae08797de7105006286dfa76dfa0.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3224-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download