3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Size 1.9MB
Sample260924-szr6hawbpb
SHA256 3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f
MD5 6640f47a8f292c4e48585fb48291036c
SHA1 757949e6951a8b049df4e3c60c00ce74e2dcdf82
SHA512 ec7c7ebddffd59dcb2d230e904c5699d1b8f539c1ba52fefb70d485c0aa8abf8015e4eea975df47c7f85f3fe442d4ab4e9e0098962ee9ca78ecd39eac9e52d8b
SSDEEP 49152:9xggETA3iiTHcf428asHGhQvt3ECtLtOPW5mCgJB2A1:9xgJAlwf83/S9PWmfJIA1
TLSH
T1589533C254AAE93EF2D3547AFA60D8C02609ED16045627E309BBFD1DBA31B9817D07D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\JIwpXhaMGe.sys	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
File created	C:\Windows\System32\drivers\AXlosVXAJ.sys	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\JIwpXhaMGe\ImagePath = "system32\\DRIVERS\\JIwpXhaMGe.sys"	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AXlosVXAJ\ImagePath = "system32\\DRIVERS\\AXlosVXAJ.sys"	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe

Executes dropped EXE 2 IoCs

pid	Process
2072	2503.tmp
3624	265B.tmp

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000830000-0x0000000000D84000-memory.dmp	upx
behavioral2/memory/3708-14-0x0000000000830000-0x0000000000D84000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Token: SeShutdownPrivilege	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Token: SeDebugPrivilege	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Token: SeDebugPrivilege	2072	2503.tmp
Token: SeDebugPrivilege	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Token: SeLoadDriverPrivilege	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
Token: SeDebugPrivilege	3624	265B.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2072	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe	89
PID 3708 wrote to memory of 3624	3708	3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe	90

C:\Users\Admin\AppData\Local\Temp\3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe
"C:\Users\Admin\AppData\Local\Temp\3ac37e42b89738e92c47e4efbac4ff4bfed61a9ee654a48be18a12bab26a3b8f.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Temp\2503.tmp
  "C:\Users\Admin\AppData\Local\Temp\2503.tmp" 672
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\265B.tmp
  "C:\Users\Admin\AppData\Local\Temp\265B.tmp" 692
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2503.tmp

Path C:\Users\Admin\AppData\Local\Temp\2503.tmp
Size 463KB
SHA256 19be87d2f3074e1d1156f257542011a0e513caabdd9b55e5563a7a69fadecdff
MD5 ae2a1058617b2173ca48c9b3fcd78fed
SHA1 8fc27c2f589cd757ed5d9781aa9bab1481d52bf9
SHA512 06ba382631d7386cf457ad4d6835439e3a9c213a124504e55b1375b5deb374e673d2c9e33c394d25e608b1b4cad4c88af598abe454bbc4e3480d0450f6c414a0
SSDEEP 12288:qeq98eSx5cA1zXpDm649VCClXyctmS5V2NDduFxkH:S9Fka8Xpe9VCClXyctmS5V2NxuFxkH
TLSH
T1CDA48CD5779009F9D177D23CC9920A16E6B27826076093CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-0-0x0000000000830000-0x0000000000D84000-memory.dmp

Download

memory/3708-1-0x0000000000D82000-0x0000000000D83000-memory.dmp

Download

memory/3708-14-0x0000000000830000-0x0000000000D84000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads