Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
wps_wid.cid-1268549705.1789025536 (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
wps_wid.cid-1268549705.1789025536 (1).exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target wps_wid.cid-1268549705.1789025536 (1).exe
- Size 5.2MB
- Sample260910-jfml8shp5z
- SHA256 700d9f2839d6e1d478d19e0d3811831181f70eb9723ee0c94e36bffa6398e56a
- MD5 70dfcba83646c4004ecfd524d3b77783
- SHA1 46dccea847a47de3b578bca2fdacd6b7a2613639
- SHA512 4cbd4dfdc306320617493d11e621952c94875b7937e6de1661f2217817dd52d69fd4d924f2693083b298691ac5eac73e33db36954153940011178cfcc6b2d770
- SSDEEP 98304:L1+aa03WzaU0Nys6hRJt0NkVajdCyQkpIQK/+:AagNBahykpbm+
- TLSH T1B146BF51F78A85F1F59201B0597ABB7E583DAE284B3085C7A3D01D6A84302D37A37B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 wps_wid.cid-1268549705.1789025536 (1).exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wps_wid.cid-1268549705.1789025536 (1).exe - Modifies system certificate store 2 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\FlightRoot wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TestSignRoot wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedDevices wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\OemEsim wps_wid.cid-1268549705.1789025536 (1).exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs wps_wid.cid-1268549705.1789025536 (1).exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 6088 wps_wid.cid-1268549705.1789025536 (1).exe 6088 wps_wid.cid-1268549705.1789025536 (1).exe 6088 wps_wid.cid-1268549705.1789025536 (1).exe 6088 wps_wid.cid-1268549705.1789025536 (1).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wps_wid.cid-1268549705.1789025536 (1).exe"C:\Users\Admin\AppData\Local\Temp\wps_wid.cid-1268549705.1789025536 (1).exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:6088