Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 04:29
Behavioral task
behavioral1
Sample
Private1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Private1.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Private1.exe
- Size 2.6MB
- Sample260826-e4kekascja
- SHA256 3baa87863d025aa1c115c0ba7fe53157f3aae0e6696aa972ea52fc3ab587eafe
- MD5 d256c43651df13aa42f626b4a8890f99
- SHA1 05ed9146a55502789e837cc37a6c6be467312257
- SHA512 22c014156cd9ef8f1ab22e7198a92ac2ac03c282f48e880269b6605b9bb9498d2d4341612b5bbdbdde0fdafe97a9536003ec237860dab2a6ea33d991080d131c
- SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVus:WXzhW148Pd+Tf1mpcOldJQ3/Vus
- TLSH T16BD5D0716F021790EF64337D9C7D204B8B4ABD1EC92B07FD25648BA3096E2B5CF96909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Private1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ icsys.icn.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe - Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Private1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Private1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion icsys.icn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion icsys.icn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe - Executes dropped EXE 6 IoCs
pid Process 3760 private1.exe 2876 icsys.icn.exe 3716 explorer.exe 3344 spoolsv.exe 3556 svchost.exe 3276 spoolsv.exe -
resource yara_rule behavioral2/memory/2768-0-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/files/0x000d00000001c448-12.dat themida behavioral2/memory/2876-14-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/files/0x000e00000001c44a-18.dat themida behavioral2/memory/3716-24-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/files/0x000e00000001c44c-32.dat themida behavioral2/memory/3344-34-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/files/0x000e00000001c44e-42.dat themida behavioral2/memory/3556-44-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3276-49-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3276-54-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3344-56-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/2876-57-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/2768-58-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3716-59-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3716-60-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3556-61-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3556-71-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3716-72-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3716-82-0x0000000000400000-0x0000000000A16000-memory.dmp themida - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Private1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA icsys.icn.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2768 Private1.exe 2876 icsys.icn.exe 3716 explorer.exe 3344 spoolsv.exe 3556 svchost.exe 3276 spoolsv.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe Private1.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Private1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2768 Private1.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 2876 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3716 explorer.exe 3556 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2768 Private1.exe 2768 Private1.exe 2876 icsys.icn.exe 2876 icsys.icn.exe 3716 explorer.exe 3716 explorer.exe 3344 spoolsv.exe 3344 spoolsv.exe 3556 svchost.exe 3556 svchost.exe 3276 spoolsv.exe 3276 spoolsv.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2768 wrote to memory of 3760 2768 Private1.exe 89 PID 2768 wrote to memory of 2876 2768 Private1.exe 91 PID 2876 wrote to memory of 3716 2876 icsys.icn.exe 92 PID 3716 wrote to memory of 3344 3716 explorer.exe 93 PID 3344 wrote to memory of 3556 3344 spoolsv.exe 94 PID 3556 wrote to memory of 3276 3556 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Private1.exe"C:\Users\Admin\AppData\Local\Temp\Private1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\users\admin\appdata\local\temp\private1.exec:\users\admin\appdata\local\temp\private1.exe2⤵
- Executes dropped EXE
PID:3760
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3276
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\private1.exe
- Size 47KB
- SHA256 9549d30adaa38d351a4b2adaf73e8ced73831228f0c557450ea88711e49c8c21
- MD5 d1c9acffdb8a61d880355395af06853c
- SHA1 2cef784b247e51e6100e5296bf51ad3e93c1ebeb
- SHA512 d35d77e1071ff3cd0237236f5ec59622b2e53f5d5367ac8d2dc47339cc766ae4f6f28e96512d0e68cb42a24301f6c16d5529e79ce8ae43c761cf846e93a50de9
- SSDEEP 768:3VUQDr1Dg2PqgvMpvBec4x8NSBFyOL2RFDI2DROqHfSzx:TgYq3Bv4mSDNUImfSzx
- TLSH T1D5234D17775500E8C269A3BC82972A02E3BAB805131197CF13D1D1562FB76D1EE7FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 2.6MB
- SHA256 38341126ed5b0d3c8c2380a4f3bb638d5b23cce227029d61a300516a9e85857a
- MD5 025a41d924eb510d1023064da8389f23
- SHA1 20a569c5ec7cf5063b4440994d224d70e6bb666d
- SHA512 3c695c6e32e00c568b3d3d52d37c8a48780b497e395693fad252cc853923be4230c776289526e9d90757938fff60d134a10ca9b177c6f417114c63aa2546ac30
- SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVm:WXzhW148Pd+Tf1mpcOldJQ3/Vm
- TLSH T1ACC5C007D0FEC23DC819BF3897AB656E287DAD964D077546F01D2059B14BB338A0AF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 2.6MB
- SHA256 2320b67561eeaa15c0df8ed5853445b13513f178f88ad5c2854310997d0f9f92
- MD5 59d077cb9443ff84cb2c25bc77278c2d
- SHA1 d7448bf62e2d77de7398d7ccb324001c370bf33e
- SHA512 6ef16cc0eec8096b3012538bdcdfe9e16eac241991d72cf58b27f5b3219509a0358b02cd4910a3e6b994057f06395a4992b0e23908eba2b282b5f7b9fa2bce63
- SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVQ:WXzhW148Pd+Tf1mpcOldJQ3/VQ
- TLSH T1DAC5C0716E021790EF64337D9C7D204B8B4ABE1FC96B07FC25648BA3096E1B5CF96909
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 2.6MB
- SHA256 99db678a35974f90ffed30d00100548b9d75b92054f4b10f5bd9cf5f88579370
- MD5 b86f07aaedb5d15a6d07116ca62afb20
- SHA1 8a9f0059288010ed34f49e221ceb37dbb4ee9a11
- SHA512 45bf988df76068bea4d13b9fb029bce3f7d0c444510399c9f9fc9602fc476b19d27e8dee1ba6248f95ebc0eceb1080a4db3f3cbe4cbdfaa469adccbf3e644140
- SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVZ:WXzhW148Pd+Tf1mpcOldJQ3/VZ
- TLSH T116C5D01F71ADAD1FECCD37364CA56C46481F266A77C59E3EC229FC3464E34A48E2811A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 2.6MB
- SHA256 ae88c2dd50bc0fe57cdbd7dd7d5b75734237770377f838dfc6e5970cc59194ba
- MD5 d943852ea76af20784339c338defe2a3
- SHA1 835002bf6bacb1cb5b3aef3d7b762b26f2b26b4b
- SHA512 c09d3235701e64044ec9151019418df102659e55738c00e4b6e6c08991e379ba430b120369ef9b7b754fc1cbc6d08b685b88c75e1d9009bdd255202f8dc3f43d
- SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVU:WXzhW148Pd+Tf1mpcOldJQ3/VU
- TLSH T126C5D07A4161A3CFC7172F74396A5254CB0A1C6E6164920EFC0BF97F29B257E72B180E
- MD5 SHA1 SHA512 SSDEEP TLSH