915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe
Size 1.9MB
Sample260916-hca9cstyhw
SHA256 915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe
MD5 0b29ee541716a1ca518ce59b86328b51
SHA1 c9ebcfac2cdd886c482cc363f468ed04ce1a2e27
SHA512 5be9f1ea442f5449a99c183caa729a2bc3e52398039f8251ee154b2418beee6f2f609ecde9f6a179bd382516af62ff7ff06bd6d73ae24d490aba02585c867d96
SSDEEP 49152:VBMXbvJV6SbAXwiK31J73FBX624pscAyjFhO7:/gDJVxcXHo1J73FlP4s8hA
TLSH
T1A495D065ED72FE14C74B34392444ED5FC5AB2E285CE14B2EC3908B1D894BAC0976F1BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1208	hello.exe
5284	baoxiniao.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4328	EXCEL.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 1208	3420	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe	88
PID 1208 wrote to memory of 2432	1208	hello.exe	90
PID 2432 wrote to memory of 4328	2432	cmd.exe	91
PID 3420 wrote to memory of 5284	3420	915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe	92

C:\Users\Admin\AppData\Local\Temp\915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe
"C:\Users\Admin\AppData\Local\Temp\915104024e77f2d75d73c6d4c6161277be7fcfc92dd286990fa3b8d4fbbef5fe.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\hello.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hello.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start 报喜鸟-知行学堂人事专题班报名表模板.xlsx
    3⤵
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\报喜鸟-知行学堂人事专题班报名表模板.xlsx"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:4328
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\baoxiniao.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\baoxiniao.exe"
  2⤵
  - Executes dropped EXE
  PID:5284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

baoxiniao.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\baoxiniao.exe
Size 3.0MB
SHA256 38622ac802d2223e6a9e8ee7ab6578fd0dcd9fe31ff98746b0381e5729a13dd1
MD5 6029c818b15da2bd4cedb5f5803fe201
SHA1 f956897d5592af214c113d686a3b57c49c1b1ca0
SHA512 47f66e8bc8f68808d188d01865d150629b2f96a01db6e47432ce80758cf71bd092406c43fd49c3825654ff74c60e2a81c21fbda243e495d8309e51a02f272cad
SSDEEP 12288:VoglGvb98UWYgeWYg955/155/sPV2haGwUWhIaBO7kAJYEp:V/Gvb98GYaGwUkIGO7kAJYE
TLSH
T104E55212A13DE8C3F99C6C7698C8C76D1DD12C1C0936146EF683B6E9D53F143EA226E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hello.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hello.exe
Size 2.1MB
SHA256 1422871198481cbb378c380fe9bf79a818a2ce3c66fb5de3fc68c27755f44c41
MD5 46b68e1c599951f7f16035a5b4fa5976
SHA1 28c31fd2d00051406b9572ea9c0399845c01a3be
SHA512 1a2766b6117379f7d0c3435c64af73adeca44169e3043c4eda8c3465aebeb3011881049f6ec9cc1672233dc45c16aa5ddff923aa467c2d0880b520d7d6530a2e
SSDEEP 49152:hBW3CZrb/T4vO90dL3BmAFd4A64nsfJdgXVufvKRID139rw3yKjoWO4N:63j0t9rkJMW
TLSH
T1D4A57B43BC9464B6C5AA92328A7592E17731BC480B3127C73B14B7BE2F727D85E35398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

报喜鸟-知行学堂人事专题班报名表模板.xlsx

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\报喜鸟-知行学堂人事专题班报名表模板.xlsx
Size 11KB
SHA256 e482d9fbcf6286b80042eab54bfdd8549acee04b94439d5b27ddd60141f4ca7a
MD5 b5b8e5b5c88de027090e7fa1c4bae2e0
SHA1 e909c08fca01e795da0f829b8b7f42e1d3d7086c
SHA512 2446f21814db4d5e222de8c92821d34aa489ac68a0b9897f9e51938ffc3ab77908900b1592f42e3489e49712adcf59ebe5ee07dd161861fc1337c2e7b424af50
SSDEEP 192:5ryHj21vdXg0B8KY7ykU1TEAbA0xmJJ9epZ6wJ+kFKZ/HLDRUj8nJvlb:5rMWvBBuykaIJJQCBUKZDD1Jvlb
TLSH
T1CD327C65EE564412D226E3F553690B2A623DB030096BC7167D90A8AC4917BFC2F8F7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 21793edb261f31f6690aac0119c5a8444c435b289ce225b9960eebdcca4d9b08
MD5 c6fd15a7a224affaa92ec1197efd82c1
SHA1 1514b4b03f95e1674d8234c85b45dd5e0089f877
SHA512 4559eeb54bcba43909d17be8a8ba1e57a0890141b5fcce3a41201b24bf9b3607717fbcca97d7ae579d8aa79b2c5307fcd56744684e382726c35e93513de0c3b2
TLSH
T103512F020E934F2FE560077A3A37875EE372F94BAB51EB1D6AC0523F7C758108889A19
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4328-22-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-21-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-23-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-24-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-59-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-30-0x00007FF884AD0000-0x00007FF884AE0000-memory.dmp

Download

memory/4328-31-0x00007FF884AD0000-0x00007FF884AE0000-memory.dmp

Download

memory/4328-16-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-57-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-56-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/4328-58-0x00007FF886DC0000-0x00007FF886DD0000-memory.dmp

Download

memory/5284-29-0x00007FF601F80000-0x00007FF602293000-memory.dmp

Download

memory/5284-37-0x00007FF601F80000-0x00007FF602293000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads