Analysis
- user interaction
yes - max time kernel
150s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/09/2026, 23:52
Behavioral task
behavioral1
Sample
Sonic.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Sonic.exe
Resource
win11-20260911-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Sonic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Sonic.exe
- Size 55KB
- Sample260924-3wr2favdpb
- SHA256 31cda8cb01e20e40f402eefac7da19cb6052656b0bcfa4947e108612adf70f2b
- MD5 6bd84911db589b9d0b07d01f03b93522
- SHA1 617fcefc893e79f6ba4b72ec164a30e6c093ac2d
- SHA512 7ac59356b68c05249ac92f933c6d8999f73df2f58edca485a5ab38067837bacaacd0762c9e0976889f38a29f84974f446f5bc6f9fa0525f742d632354047819b
- SSDEEP 1536:+VpMDnE4uNRty4XXzdhDVwsNMD8XExI3pmXm:QMDnlYk4XxhDVwsNMD8XExI3pm
- TLSH T1DD432844BFEA4A05E2BD8F3468F655150634BA23E532EB1F48D668DB17327C58C80FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd97bfec8a7027b3c7b5017a3c3ecd1d.exe Sonic.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd97bfec8a7027b3c7b5017a3c3ecd1d.exe Sonic.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\cd97bfec8a7027b3c7b5017a3c3ecd1d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sonic.exe\" .." Sonic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cd97bfec8a7027b3c7b5017a3c3ecd1d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sonic.exe\" .." Sonic.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sonic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sonic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe 896 Sonic.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 896 Sonic.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 896 Sonic.exe Token: SeDebugPrivilege 8 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe Token: 33 896 Sonic.exe Token: SeIncBasePriorityPrivilege 896 Sonic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sonic.exe"C:\Users\Admin\AppData\Local\Temp\Sonic.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:896
-
C:\Users\Admin\AppData\Local\Temp\Sonic.exe"C:\Users\Admin\AppData\Local\Temp\Sonic.exe" ..1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:8