Analysis
- max time kernel
298s - max time network
282s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/09/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026年第2季度内职人员违纪名单信息.exe
Resource
win11-20260911-en
windows11-21h2-x64
7 signatures
300 seconds
General
- Target 2026年第2季度内职人员违纪名单信息.exe
- Size 284KB
- Sample260916-nylj4sty2m
- SHA256 57a767685d062e064e47012f45b242ced8dbd7e8417ef42c19fd685f7c5791d7
- MD5 c2c7b32b2c38a2d7f80ee7e0b5616ec4
- SHA1 8ae001005612d25716220277569bc4e93a95d882
- SHA512 b4af835892b213268cf6a1671c32e5f8afa73d932b0c94fc797923ea94189f2ec4a27ef4ba8808a2f1f0b8ec720295648c08bd8d8cb00bcfe88f71d8c9ec0f0c
- SSDEEP 6144:hT+3AfkpQwFVmbj+zz6vSATSu/IeoDA6XD:g3ikewFVmbj+zvz
- TLSH T19754730AEB6E68F9C4BBD5359282222AF9B13C9443B46FC757410F9B47637E4A53C384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 svchost.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe 5896 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4304 2026年第2季度内职人员违纪名单信息.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4304 2026年第2季度内职人员违纪名单信息.exe Token: SeDebugPrivilege 5896 svchost.exe Token: SeDebugPrivilege 5896 svchost.exe Token: SeDebugPrivilege 5896 svchost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4304 wrote to memory of 1244 4304 2026年第2季度内职人员违纪名单信息.exe 20
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5896
-
-
C:\Users\Admin\AppData\Local\Temp\2026年第2季度内职人员违纪名单信息.exe"C:\Users\Admin\AppData\Local\Temp\2026年第2季度内职人员违纪名单信息.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304