Analysis
- max time kernel
150s - max time network
78s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/09/2026, 23:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe
- Size 18.1MB
- Sample260917-2y95cssz3j
- SHA256 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200
- MD5 bf549e04eec008624d22bf0d83a4e766
- SHA1 e738442c6d85a7d377b45714d6671bcb6f8aae59
- SHA512 705057f7915614748e0a4300133ba0e717f5063291c85fc0db3763f12f4488d4ef5e81bf67486a921475691aa553c96a2034b95a3915c480814c44c5f10b31e8
- SSDEEP 393216:tSPNgCbwPeHzarPQWtqdJ3uyKqxw8nWaeef/jAI11gXj:tVzmH+rPmv3F5xbZX1E
- TLSH T1B417CF4763FA0A98F4F7DB7885BB62129576BC599F21D7DF1260804E1E22BC08934B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 432 cmd.exe 1272 cmd.exe - Delays execution with timeout.exe 2 IoCs
pid Process 2228 timeout.exe 4284 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeIncBasePriorityPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: 33 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeLoadDriverPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeProfSingleProcessPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeBackupPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeRestorePrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeShutdownPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeTakeOwnershipPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe Token: SeSecurityPrivilege 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3156 wrote to memory of 1272 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 87 PID 3156 wrote to memory of 432 3156 47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe 88 PID 432 wrote to memory of 2228 432 cmd.exe 91 PID 1272 wrote to memory of 4284 1272 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe"C:\Users\Admin\AppData\Local\Temp\47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe"1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c timeout /t 600 /nobreak >nul 2>&1 & taskkill /f /pid 3156 >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\47556c4f7e9a40ed785d97a2e781008894f1361bf0971f13a449677812e9c200.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\timeout.exetimeout /t 600 /nobreak3⤵
- Delays execution with timeout.exe
PID:4284
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c timeout /t 900 /nobreak >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ss_dbg.txt" "C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log" "C:\Users\Public\ss_release_debug.log"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\system32\timeout.exetimeout /t 900 /nobreak3⤵
- Delays execution with timeout.exe
PID:2228
-
-