514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8.exe
Size 434KB
Sample260831-fe1wpavdra
SHA256 514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8
MD5 85df3bcca3e4804f4e8c3bc5bc459750
SHA1 5ff9da810c6acf8b97818c1f60d1e36532816081
SHA512 207e5fed360813e22d29c2f353c3cf6a3a8f661f0ef7c5da51faeacb0a2cededbd42a0552b144983d158e8cb4e11c751d2d678757ed163486a5c960a2a0e695a
SSDEEP 6144:JLH/ZjflZNa1hbvJ0o0oDzr7QyDUye/8rtVtgH9+AoYlW57L4VV3jofMq25h7c:bpTavD0oHr7FekrtsAAoYlgL4HB3hA
TLSH
T1D89423DD734DCEA2D44420BF6FCF618853B0D8EB6561E38679D6130FAD863C7A628026
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2684	SourceException.exe
4400	SourceException.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 1188	2684	SourceException.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SourceException.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SourceException.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2684	SourceException.exe
2684	SourceException.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8.exe
Token: SeDebugPrivilege	2684	SourceException.exe
Token: SeDebugPrivilege	1188	InstallUtil.exe
Token: SeDebugPrivilege	4400	SourceException.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1528	1140	514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8.exe	90
PID 2684 wrote to memory of 6072	2684	SourceException.exe	94
PID 2684 wrote to memory of 1188	2684	SourceException.exe	95
PID 2684 wrote to memory of 1188	2684	SourceException.exe	95
PID 2684 wrote to memory of 1188	2684	SourceException.exe	95
PID 2684 wrote to memory of 1188	2684	SourceException.exe	95
PID 2684 wrote to memory of 1188	2684	SourceException.exe	95

C:\Users\Admin\AppData\Local\Temp\514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8.exe
"C:\Users\Admin\AppData\Local\Temp\514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "SourceException" /XML "C:\Users\Admin\AppData\Local\Temp\ee9d3c1c29aa4641beed078edd4b8d96.xml" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1528

C:\Users\Admin\AppData\Local\Current\jjumyxbo\SourceException.exe
C:\Users\Admin\AppData\Local\Current\jjumyxbo\SourceException.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:6072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1188

C:\Users\Admin\AppData\Local\Current\jjumyxbo\SourceException.exe
"C:\Users\Admin\AppData\Local\Current\jjumyxbo\SourceException.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SourceException.exe

Path C:\Users\Admin\AppData\Local\Current\jjumyxbo\SourceException.exe
Size 434KB
SHA256 514d13d0bb634f4b8f7645d22e740ec191f2157ce4fd4c754452e3a139d7a4f8
MD5 85df3bcca3e4804f4e8c3bc5bc459750
SHA1 5ff9da810c6acf8b97818c1f60d1e36532816081
SHA512 207e5fed360813e22d29c2f353c3cf6a3a8f661f0ef7c5da51faeacb0a2cededbd42a0552b144983d158e8cb4e11c751d2d678757ed163486a5c960a2a0e695a
SSDEEP 6144:JLH/ZjflZNa1hbvJ0o0oDzr7QyDUye/8rtVtgH9+AoYlW57L4VV3jofMq25h7c:bpTavD0oHr7FekrtsAAoYlgL4HB3hA
TLSH
T1D89423DD734DCEA2D44420BF6FCF618853B0D8EB6561E38679D6130FAD863C7A628026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee9d3c1c29aa4641beed078edd4b8d96.xml

Path C:\Users\Admin\AppData\Local\Temp\ee9d3c1c29aa4641beed078edd4b8d96.xml
Size 1KB
SHA256 a72ec32bbb5764c660f04face0e3ae3bfa6a6b2396f4e83abb94ad46357ab862
MD5 90e55954688600fc68d373793e51d0bc
SHA1 8487ffeb2a83bc2a75ff080a9d44ede4b8547d65
SHA512 51549c74536d96e50455bcfc5df729fbc2ba1beb2b8f09c9e169bf4aa45f4fb5d08ae08c1c62ce2dd923b0606ee6476732605462c18df99861d1733a15337078
TLSH
T10331D2649CC0760B6533453AE7919682FE3397A306970035F5CC473F3FBA58A518356B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-4-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/1140-0-0x0000000074C52000-0x0000000074C53000-memory.dmp

Download

memory/1140-3-0x00000000052F0000-0x0000000005908000-memory.dmp

Download

memory/1140-5-0x0000000004FB0000-0x0000000005016000-memory.dmp

Download

memory/1140-2-0x0000000004BD0000-0x0000000004CC8000-memory.dmp

Download

memory/1140-8-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/1140-1-0x00000000000A0000-0x0000000000112000-memory.dmp

Download

memory/1188-14-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/1188-16-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/1188-17-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/2684-10-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/2684-11-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/2684-13-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download