dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe
Size 813KB
Sample260822-pvdwjayybs
SHA256 dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c
MD5 e387cfc4294dd41a41661eca9ef13734
SHA1 4f8b1810e93096ababe6fbd2850f3e7e62a8d6a8
SHA512 c388a98e9693bbfa50202e8ecf0e29ff0f496016b0c27be78a62e539b4a8648d292b72543d463a2a79a811ed5dd94377fa3f1f12df494390a5bf2595944108dc
SSDEEP 24576:Y4Jupg1zPKXkk3d5PNd3h5IqYaRXB6QwUyYvmAecrXwz3pWvgxh:YGzFb
TLSH
T159053C237121C4A3D0212FF556A616347CF88B1D2D78A863AFD4BEA6BCB4533CB2651D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DBE8DF096937F6764D95DBA5319FC71D2BE2C95B7E0EB3C3D4A760DB50EB0C6C.EXE	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DBE8DF096937F6764D95DBA5319FC71D2BE2C95B7E0EB3C3D4A760DB50EB0C6C.EXE	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\LanguageConfiguration	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	5056	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe
Token: SeRestorePrivilege	5056	dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe

C:\Users\Admin\AppData\Local\Temp\dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe
"C:\Users\Admin\AppData\Local\Temp\dbe8df096937f6764d95dba5319fc71d2be2c95b7e0eb3c3d4a760db50eb0c6c.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/5056-1-0x000000006F610000-0x000000006F620000-memory.dmp

Download

memory/5056-2-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads