2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Size 9.2MB
Sample260823-hlmczseq9t
SHA256 2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783
MD5 0dfe7d1c5c7847336acedc06a290b3c8
SHA1 e203f72041d64f63c99664f2ecadb72881025d11
SHA512 97550fae12bb970f83cb318486511a348eabf537264cc87cd12a657ba8633d148b271d30e5d3843974b87ded8eddd6c2447ddc991e017e289c7e695929833ea5
SSDEEP 196608:F/pAwGsQox9W+TQlihel4yfZmbYsFDVX7ZWoUeAJ5FlQMB:5pA6QojVSCe23Bb7Xc5Flj
TLSH
T181A63347D79E8C3CE32351BBE6999FEC9F77E2B644883256C62E02D8F65C92ED564000
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4032	sg.tmp
2368	系统安装器_x86.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2368-14-0x0000000000F30000-0x0000000001F98000-memory.dmp	autoit_exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x0000000000400000-0x000000000057B000-memory.dmp	upx
behavioral2/files/0x001600000001c545-11.dat	upx
behavioral2/memory/2368-13-0x0000000000F30000-0x0000000001F98000-memory.dmp	upx
behavioral2/memory/2368-14-0x0000000000F30000-0x0000000001F98000-memory.dmp	upx
behavioral2/memory/4852-15-0x0000000000400000-0x000000000057B000-memory.dmp	upx
behavioral2/memory/4852-29-0x0000000000400000-0x000000000057B000-memory.dmp	upx
behavioral2/memory/1964-31-0x0000000000400000-0x000000000057B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe
1344	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	系统安装器_x86.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeBackupPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeRestorePrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: 33	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeIncBasePriorityPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: 33	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeIncBasePriorityPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: 33	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeIncBasePriorityPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeRestorePrivilege	4032	sg.tmp
Token: 35	4032	sg.tmp
Token: SeSecurityPrivilege	4032	sg.tmp
Token: SeSecurityPrivilege	4032	sg.tmp
Token: 33	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeIncBasePriorityPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeDebugPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: 33	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeIncBasePriorityPrivilege	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeBackupPrivilege	1964	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeRestorePrivilege	1964	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: 33	1964	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
Token: SeIncBasePriorityPrivilege	1964	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3368	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe	89
PID 4852 wrote to memory of 4032	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe	91
PID 4852 wrote to memory of 2368	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe	93
PID 4852 wrote to memory of 1964	4852	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe	95
PID 1964 wrote to memory of 1344	1964	2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe	96

C:\Users\Admin\AppData\Local\Temp\2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
"C:\Users\Admin\AppData\Local\Temp\2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\~2508030777080178008~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~5739627346760521987"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\~5739627346760521987\系统安装器_x86.exe
  "C:\Users\Admin\AppData\Local\Temp\~5739627346760521987\系统安装器_x86.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\2a561f4f660aeef26daf1755cc27c85bf2fc9bfd927d54b5223d0f9afe991783.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~6919516110563201811.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~6919516110563201811.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~2508030777080178008~\sg.tmp
Size 838KB
SHA256 e572ed07a5998c8fc256da630bf6f902c511605d665a6aa7120e75adb668ed26
MD5 e34a35b92c6337cf750665b1365a3cc2
SHA1 9ca4a1c3c1a9bf621620da9ba29c7077e8bb4417
SHA512 cac4d5ca19f1011fe18e7f3aca740002d24c83aa0d63c47b9eb0a1f30931eed16df4f05757e61235a93d8981b0d1bdfcc0dda7fdcc9e9c6bc72d0abdd9895a28
SSDEEP 24576:wcyxh7By5I3a+m8H/v9rgC1zCjz/qNdChzDsa4c+we:wcU7Ssa+m09UAWzKRaXe
TLSH
T1CC05AE127BE5D0BBD25211318B1DBBF691F993680B2448CB67808F5C7B319D1DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

系统安装器_x86.INI

Path C:\Users\Admin\AppData\Local\Temp\~5739627346760521987\系统安装器_x86.INI
Size 871B
SHA256 722e8af2f1be6fad31b4244c09366415097ac336f05387ec93af256dc2f47421
MD5 493efb3df5955070ee51ed32098f7a52
SHA1 aa1f8fc5ca9530408c5f9918eae8d9a8bba3c869
SHA512 a803920fc2abf5c961dc5c454c13856e04f0ce9f6d3ebb8db2402d293680c67e28f663b7f7e380251f57a0e6bf6f460c9c9a3909a1afb1e482be1f735cabd29b
TLSH
T19E11960A9907C9D7E2C0657008362A1698C3A14398B4C34F149009F18F0D0ADF932769
MD5 SHA1 SHA512 TLSH

Submit Download

系统安装器_x86.exe

Path C:\Users\Admin\AppData\Local\Temp\~5739627346760521987\系统安装器_x86.exe
Size 8.2MB
SHA256 1a04d94a2816c2ad02c3b3609a06860b835373cf6660458b4d762590370cf4ef
MD5 9478fdcb92e7b2f09821b2131ff5d0e6
SHA1 e02b392e05bd4ed85496331410e2c3c4a00563ac
SHA512 563a48cd4f2990cc8f584fe5a160712aa617378a312c15dde808beff0679a051269812c930c30731b6cb663d99160f49c77f0c69df5c27fa4b92575c59d0d1cc
SSDEEP 196608:yvQoO9kZ9z66Wo7C0EH93rK11VqzmtfeuiGQNY0+:hoo4e3oG5mYziuGQN+
TLSH
T1F7963307D74A482DD313D2BAF1D99FDCAE77E3B38888321AC62E22D5F74C59EA564404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~6919516110563201811.cmd

Path C:\Users\Admin\AppData\Local\Temp\~6919516110563201811.cmd
Size 373B
SHA256 e97ce3644bb106cab2d3b654b6a2a4c1e9a8c1625532e7628386fe5aca47c819
MD5 05f911562d7954df31c2d859fd4988b7
SHA1 650ba5f192c7385d90c9e5f4e0f33dbd77c1ff35
SHA512 1e75ff06e34bedaa8ec6f0be1bf12b3453f1f02866449c20180974e6483ca26fdc40eb6a023dff8735633b378809f99a5d9b6580555a6a71917e9abc28b1f443
TLSH
T1EEE0686265825EEA88182EFB07FAD008C290CE173F4AFB8441B006083146676A993A8A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1964-31-0x0000000000400000-0x000000000057B000-memory.dmp

Download

memory/2368-13-0x0000000000F30000-0x0000000001F98000-memory.dmp

Download

memory/2368-14-0x0000000000F30000-0x0000000001F98000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x000000000057B000-memory.dmp

Download

memory/4852-15-0x0000000000400000-0x000000000057B000-memory.dmp

Download

memory/4852-29-0x0000000000400000-0x000000000057B000-memory.dmp

Download