915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe
Size 1.9MB
Sample260916-hca9cstyhw
SHA256 915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe
MD5 0b29ee541716a1ca518ce59b86328b51
SHA1 c9ebcfac2cdd886c482cc363f468ed04ce1a2e27
SHA512 5be9f1ea442f5449a99c183caa729a2bc3e52398039f8251ee154b2418beee6f2f609ecde9f6a179bd382516af62ff7ff06bd6d73ae24d490aba02585c867d96
SSDEEP 49152:VBMXbvJV6SbAXwiK31J73FBX624pscAyjFhO7:/gDJVxcXHo1J73FlP4s8hA
TLSH
T1A495D065ED72FE14C74B34392444ED5FC5AB2E285CE14B2EC3908B1D894BAC0976F1BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
3976	hello.exe
4092	baoxiniao.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2960	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE
2960	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3976	4880	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe	89
PID 3976 wrote to memory of 1244	3976	hello.exe	92
PID 1244 wrote to memory of 2960	1244	cmd.exe	93
PID 4880 wrote to memory of 4092	4880	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe	94

C:\Users\Admin\AppData\Local\Temp\915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe
"C:\Users\Admin\AppData\Local\Temp\915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\hello.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hello.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start 报喜鸟-知行学堂人事专题班报名表模板.xlsx
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\报喜鸟-知行学堂人事专题班报名表模板.xlsx"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:2960
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\baoxiniao.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\baoxiniao.exe"
  2⤵
  - Executes dropped EXE
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

baoxiniao.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\baoxiniao.exe
Size 3.0MB
SHA256 38622ac802d2223e6a9e8ee7ab6578fd0dcd9fe31ff98746b0381e5729a13dd1
MD5 6029c818b15da2bd4cedb5f5803fe201
SHA1 f956897d5592af214c113d686a3b57c49c1b1ca0
SHA512 47f66e8bc8f68808d188d01865d150629b2f96a01db6e47432ce80758cf71bd092406c43fd49c3825654ff74c60e2a81c21fbda243e495d8309e51a02f272cad
SSDEEP 12288:VoglGvb98UWYgeWYg955/155/sPV2haGwUWhIaBO7kAJYEp:V/Gvb98GYaGwUkIGO7kAJYE
TLSH
T104E55212A13DE8C3F99C6C7698C8C76D1DD12C1C0936146EF683B6E9D53F143EA226E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hello.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hello.exe
Size 2.1MB
SHA256 1422871198481cbb378c380fe9bf79a818a2ce3c66fb5de3fc68c27755f44c41
MD5 46b68e1c599951f7f16035a5b4fa5976
SHA1 28c31fd2d00051406b9572ea9c0399845c01a3be
SHA512 1a2766b6117379f7d0c3435c64af73adeca44169e3043c4eda8c3465aebeb3011881049f6ec9cc1672233dc45c16aa5ddff923aa467c2d0880b520d7d6530a2e
SSDEEP 49152:hBW3CZrb/T4vO90dL3BmAFd4A64nsfJdgXVufvKRID139rw3yKjoWO4N:63j0t9rkJMW
TLSH
T1D4A57B43BC9464B6C5AA92328A7592E17731BC480B3127C73B14B7BE2F727D85E35398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

报喜鸟-知行学堂人事专题班报名表模板.xlsx

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\报喜鸟-知行学堂人事专题班报名表模板.xlsx
Size 11KB
SHA256 e482d9fbcf6286b80042eab54bfdd8549acee04b94439d5b27ddd60141f4ca7a
MD5 b5b8e5b5c88de027090e7fa1c4bae2e0
SHA1 e909c08fca01e795da0f829b8b7f42e1d3d7086c
SHA512 2446f21814db4d5e222de8c92821d34aa489ac68a0b9897f9e51938ffc3ab77908900b1592f42e3489e49712adcf59ebe5ee07dd161861fc1337c2e7b424af50
SSDEEP 192:5ryHj21vdXg0B8KY7ykU1TEAbA0xmJJ9epZ6wJ+kFKZ/HLDRUj8nJvlb:5rMWvBBuykaIJJQCBUKZDD1Jvlb
TLSH
T1CD327C65EE564412D226E3F553690B2A623DB030096BC7167D90A8AC4917BFC2F8F7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 90c6e8fc197f1267386ea4376101919ccfa95c28232393ca303ae9d58bb4979f
MD5 1c472623bf1e614da0d44fa041fc6a1f
SHA1 047a4d1fd3f7e076f23ede1ab5fee3a6ea5cd287
SHA512 65b88486b5cad976ae7d1462ce2bc38d5243f2ae1e3193882edefa7151e6973e08387247f1b906213ada04b8b4c0cd3aacca773157ae553b33a512be0e68c05b
TLSH
T1A421231167E79B2AE0220F742737C715C7A0BD16E308824F629D122B3EF2A408B5DF4B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2960-20-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-23-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-18-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-16-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-60-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-28-0x00007FFF3D340000-0x00007FFF3D350000-memory.dmp

Download

memory/2960-29-0x00007FFF3D340000-0x00007FFF3D350000-memory.dmp

Download

memory/2960-19-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-58-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-57-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/2960-59-0x00007FFF3F590000-0x00007FFF3F5A0000-memory.dmp

Download

memory/4092-27-0x00007FF7689C0000-0x00007FF768CD3000-memory.dmp

Download

memory/4092-41-0x00007FF7689C0000-0x00007FF768CD3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads