a78799e30ca91e087f0b5fd31533ee342125480c99979133603568cff1ccb045

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08432ff4b2cd9c0185d868d8f960800c.exe
Size 11.5MB
Sample260825-pyk41sal5w
SHA256 a78799e30ca91e087f0b5fd31533ee342125480c99979133603568cff1ccb045
MD5 08432ff4b2cd9c0185d868d8f960800c
SHA1 f22f7d160ae06c33d3ac1b13d110f8cb78beb90b
SHA512 52095a7d1a50dcc1970ecf0c176067bc42b68224219c33d8ccd7558c6b14820074f29b9e7006b27da81e2e67f4d1066ee892de5a0c5ef1f97dac21cd7dcb7baa
SSDEEP 98304:XO9fI4+LNdf/RS5U9QSNMJ/mbTE3GZRuQPIYrQtETMpE:XqFCMVmbIWPuQ1rQcT
TLSH
T16FC63A47E8A545E4C0AED136CA679263BA713C884B3563D36BA0F7242F73BD0AD79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5472	reg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 5472	4184	08432ff4b2cd9c0185d868d8f960800c.exe	89

C:\Users\Admin\AppData\Local\Temp\08432ff4b2cd9c0185d868d8f960800c.exe
"C:\Users\Admin\AppData\Local\Temp\08432ff4b2cd9c0185d868d8f960800c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nx_sid.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\nx_sid.dat
Size 86B
SHA256 733036e4be9513515e1eca8c1d1ccaa2148e1a41516561cc677b43692c4c8dd6
MD5 05e5b481a09f5ef083d916b5f61c6475
SHA1 c1cedddb0a4343afee9594b81e5c27f4100df63c
SHA512 2d8eaf249405bd6979694d0567b9673246c3a265ee1ddf9ec5589cf41c1d1e0fdfc72d165313d2e1f6dd85a004b76a87377039040c284d3a5aea4c57702fb6fd
TLSH
T1CBA0129E72B1D4F4045545445F3282010F59100708402528FC1CA04001800030BD4820
MD5 SHA1 SHA512 TLSH

Submit Download