fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe
Size 723KB
Sample260822-psjzrsfa65
SHA256 fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594
MD5 02d3f3744b64bc73f0ef7cf7f4fc27c5
SHA1 cc4d6f41bfe2920a4a98470143194865f1aa143b
SHA512 b116371ecbfd3e9cfaf6a67bb40d40668d48679a25bdec2cd6233608406ff0e3c007885c42182f7ab876d6d325b6f2e8641b3f8365c384b1a62c03d0967cf847
SSDEEP 12288:KFmnyop6sWIDjFbFM++j2OpuKmInPzrzrOZf+oR76GFHz/0MCowfGAMfiejv48o0:KFmnyop6sWIDjFbFM++j2OpuKmInPzrG
TLSH
T16AF42A237211C493D0212BFA56E616283CB897192D799863DFD8AE637DF4632CF3A50D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\gzip.dll	fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe
Token: SeDebugPrivilege	2692	fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe

C:\Users\Admin\AppData\Local\Temp\fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe
"C:\Users\Admin\AppData\Local\Temp\fef908a0db0197c24656aece739164db22c4868697d8866676e8166d27ee2594.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Download