Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 07:56
Behavioral task
behavioral1
Sample
2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe
- Size 568KB
- Sample260826-js2xpacc57
- SHA256 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea
- MD5 6145540a3fdf7ad948f116451f59dd7a
- SHA1 47e6f4c9cf2f29cbfe95b992a876f1ba4392453b
- SHA512 190c58c4afc936add812fd6f268cece4ace50ea8b46d5746fb36d607d5dd50a26b53a35dd2348efd3a6f9afb79d99f3058f6f59648e503bf67c08959167678ba
- SSDEEP 12288:Rw2DngHTVx549xd/rNhwranvxCSAXoXmzB0VL8UsGGwClTnl2wYu:R6xi9xdbYSAXoC098UpGrz
- TLSH T108C42306518025B3E55149B02CB8B7F0D376ECE2AC1DD9BBAFAADF5F15356438C840AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3036 bhcabfebbff.exe - Loads dropped DLL 2 IoCs
pid Process 4340 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe 4340 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 2568 3036 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhcabfebbff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5116 wmic.exe Token: SeSecurityPrivilege 5116 wmic.exe Token: SeTakeOwnershipPrivilege 5116 wmic.exe Token: SeLoadDriverPrivilege 5116 wmic.exe Token: SeSystemProfilePrivilege 5116 wmic.exe Token: SeSystemtimePrivilege 5116 wmic.exe Token: SeProfSingleProcessPrivilege 5116 wmic.exe Token: SeIncBasePriorityPrivilege 5116 wmic.exe Token: SeCreatePagefilePrivilege 5116 wmic.exe Token: SeBackupPrivilege 5116 wmic.exe Token: SeRestorePrivilege 5116 wmic.exe Token: SeShutdownPrivilege 5116 wmic.exe Token: SeDebugPrivilege 5116 wmic.exe Token: SeSystemEnvironmentPrivilege 5116 wmic.exe Token: SeRemoteShutdownPrivilege 5116 wmic.exe Token: SeUndockPrivilege 5116 wmic.exe Token: SeManageVolumePrivilege 5116 wmic.exe Token: 33 5116 wmic.exe Token: 34 5116 wmic.exe Token: 35 5116 wmic.exe Token: 36 5116 wmic.exe Token: SeIncreaseQuotaPrivilege 5116 wmic.exe Token: SeSecurityPrivilege 5116 wmic.exe Token: SeTakeOwnershipPrivilege 5116 wmic.exe Token: SeLoadDriverPrivilege 5116 wmic.exe Token: SeSystemProfilePrivilege 5116 wmic.exe Token: SeSystemtimePrivilege 5116 wmic.exe Token: SeProfSingleProcessPrivilege 5116 wmic.exe Token: SeIncBasePriorityPrivilege 5116 wmic.exe Token: SeCreatePagefilePrivilege 5116 wmic.exe Token: SeBackupPrivilege 5116 wmic.exe Token: SeRestorePrivilege 5116 wmic.exe Token: SeShutdownPrivilege 5116 wmic.exe Token: SeDebugPrivilege 5116 wmic.exe Token: SeSystemEnvironmentPrivilege 5116 wmic.exe Token: SeRemoteShutdownPrivilege 5116 wmic.exe Token: SeUndockPrivilege 5116 wmic.exe Token: SeManageVolumePrivilege 5116 wmic.exe Token: 33 5116 wmic.exe Token: 34 5116 wmic.exe Token: 35 5116 wmic.exe Token: 36 5116 wmic.exe Token: SeIncreaseQuotaPrivilege 4596 wmic.exe Token: SeSecurityPrivilege 4596 wmic.exe Token: SeTakeOwnershipPrivilege 4596 wmic.exe Token: SeLoadDriverPrivilege 4596 wmic.exe Token: SeSystemProfilePrivilege 4596 wmic.exe Token: SeSystemtimePrivilege 4596 wmic.exe Token: SeProfSingleProcessPrivilege 4596 wmic.exe Token: SeIncBasePriorityPrivilege 4596 wmic.exe Token: SeCreatePagefilePrivilege 4596 wmic.exe Token: SeBackupPrivilege 4596 wmic.exe Token: SeRestorePrivilege 4596 wmic.exe Token: SeShutdownPrivilege 4596 wmic.exe Token: SeDebugPrivilege 4596 wmic.exe Token: SeSystemEnvironmentPrivilege 4596 wmic.exe Token: SeRemoteShutdownPrivilege 4596 wmic.exe Token: SeUndockPrivilege 4596 wmic.exe Token: SeManageVolumePrivilege 4596 wmic.exe Token: 33 4596 wmic.exe Token: 34 4596 wmic.exe Token: 35 4596 wmic.exe Token: 36 4596 wmic.exe Token: SeIncreaseQuotaPrivilege 4596 wmic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4340 wrote to memory of 3036 4340 2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe 85 PID 3036 wrote to memory of 5116 3036 bhcabfebbff.exe 86 PID 3036 wrote to memory of 4596 3036 bhcabfebbff.exe 89 PID 3036 wrote to memory of 2636 3036 bhcabfebbff.exe 91 PID 3036 wrote to memory of 2172 3036 bhcabfebbff.exe 93 PID 3036 wrote to memory of 4360 3036 bhcabfebbff.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe"C:\Users\Admin\AppData\Local\Temp\2f375aa830e096b51493699c2b117efc3ad4cf559b9a25ecc42cfbd37d4a35ea.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\bhcabfebbff.exeC:\Users\Admin\AppData\Local\Temp\bhcabfebbff.exe 7-8-4-2-9-3-5-4-3-2-8 KEhFQjQuLiwuMRgoS1FAR0Y/OS0eJ0c9UFVGT0ZFQTsoGSdAR0pRREA6MCwvMTUeJkBEQDouGChITk07Uj5QXEc8NiowLiswGytQQ0pPPU5dTE9HOWVybGkyKy1qYm1yK3JgXiVdbmcqX11xXyZiZmJtFyw+SEZBQ0I8OTMsMVxdX2MrJistMisqL2IyLyUyLi4zJDNgLC83MSxeXS4sMRsrQS81KhgrQik6KC0dLTwsNSkvFyw/MDorKRknQDM0KiwcLE5KSDxRQUtcS05GVDk8UTkeJk1NS0FTO01XQVNDPjgcLE5KSDxRQUtcST1KQzUZJ0FWPFxQTkk7GCg9VENWQEhASUdGPjUcLT9MTlBcQEpIT09DSTotHCxSQDpGR1dGUlpRT0o1GSdSSzQvGytBUSk2ZV5xJGMvLB0tSk5GUEdEQlpTQko7SEVBR0Q+QkFSUEQ2GCtHSlxNUUtSQUY9OXJpcmAcLFA9TU1OTEBLQltSUT1LV0A/UFA4Lh0tQEI8QVY0LhsrRlFXPVFKP0RGPltCTDtLUUxSPEE4Yl5qa14YK0JGVElITD88WEFMOyg0LSoyNCYrMCoyJx0qUEZLPTYpMDAnMywsMzYqGSdATU5LR0s+QldNQUlDNC4qMywwKCotJjQxLS82MTAiOkU=2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787731005.txt bios get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787731005.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787731005.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2636
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787731005.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787731005.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:4360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 9163⤵
- Program crash
PID:2568
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 30361⤵PID:2960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\81787731005.txt
- Size 70B
- SHA256 5c3b49db1374e42e5047a3ab05b1ee7577cf78cf6e875889a164f54d1af6257b
- MD5 5b21bdfd2dcb4143105a1642e631bf89
- SHA1 0921933e59eacc03e31a28dd8be977bc2726ee21
- SHA512 41608db131f901209389d780a5ff1561f0c1dcc0cd2b2d8ed87f60bef852b80925d6f1ca8c9230558635ea4aff4f7c1c9ec099ca5d1b3a85514b26c57b517ae4
- TLSH T1DCA00243C7DC218EF1F64514FD30506C1BC330C11D7E014C0048002B86F784446103D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\81787731005.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81787731005.txt
- Size 58B
- SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
- MD5 f8e2f71e123c5a848f2a83d2a7aef11e
- SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
- SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
- TLSH T177A00212415CC100546359409055523816936890483D1829024C004693D74015451BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bhcabfebbff.exe
- Size 826KB
- SHA256 794511bbefa0f1ebe7408748242e8f72104c6c7cb42ef3fe4e854740e114c343
- MD5 ab1636335724f5ee733a781b002b723e
- SHA1 10356da6f8d0c02f5a4ac08f85a5f9df866ac9b1
- SHA512 6f18cec44f5054829c192bf6d01cde3c2ce8e4070c1932a2e2c1cae7d2045ff2becfef4ce893759a3b91a553bf2becdb552b0d88f3d51d9ee4455f137b63be31
- SSDEEP 24576:nHhq049ANhXMK2/dSWY2PvHdANX84iUHlydIzbUv:Hhq049ANhXMKSSn2PvHdaX8jUHlmI/Uv
- TLSH T1A0059D12B6D1E032D0630031CA19B3619ABDFD3149364597B6C82A5EAFB85D2DF39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiF3C7.tmp\jjff.dll
- Size 104KB
- SHA256 0a804028761c5d7510d574ba72ae48d363ab3343e3d25be72efcb3be77b89cd0
- MD5 b6a2b722d6b5ba44802de7b2e36bf2a0
- SHA1 04d03c9430eaf8b6c06f41530e4806870bf3a8d8
- SHA512 2c06012bfdc53528d8964d777b832572adfb07d5fb850940fbc10e1aa697c0612205995b11926a4b9cdc891833baf042d76f1923616100b61b78e8042a7402c4
- SSDEEP 1536:Yn6lLkgfR1KKd29JAHC/wqPfmvw/mubNewvOQBgx2Xa+G:86lLdfR1W9CK9JJvOQBgx2X
- TLSH T1BFA36C117189C032D15B563C4A25F7B19BABB8A1CDB1AD8B3FE50ABE5F742C1DA34306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiF3C7.tmp\nsisunz.dll
- Size 40KB
- SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
- MD5 5f13dbc378792f23e598079fc1e4422b
- SHA1 5813c05802f15930aa860b8363af2b58426c8adf
- SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
- SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
- TLSH T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
- MD5 SHA1 SHA512 SSDEEP TLSH