Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CABANAS.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
CABANAS.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target CABANAS.exe
- Size 7KB
- Sample260928-e1pj4svbqf
- SHA256 64f3313cf9c8c08f5cb57ea10ac8811267d82b5092dda97922e8def41bcf7e15
- MD5 dfae6328b864a214da7d0f6ecbeeb011
- SHA1 de4c4fb9515cb2c6797a22ab3743b8e24673e24b
- SHA512 74be42a78232905b2957d5f4c82ccb08a4b59b232fc09b59f5e0d1ef3b693976083675ff242236e2b4f35602f439475dee7263b2d4dd1bed81d915306e63e5d4
- SSDEEP 96:nPY7wfXcfG7tFPyrfMICynmCt9iZMVZCTwo:nbXVFPyr0INSato
- TLSH T1EFE13AF65B54BDB6DA48A83D005A0D06D87DC1728FBF6AB10FC9390E9932482551C9CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\cipher.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\mmc.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\wscript.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\cacls.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE CABANAS.exe File opened for modification C:\Windows\SysWOW64\verifiergui.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\makecab.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\net1.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\winver.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ttdinject.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\setx.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\cscript.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\raserver.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\runonce.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\choice.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\expand.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\tttracer.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\whoami.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\mshta.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\hh.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\icacls.exe CABANAS.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe CABANAS.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\winhlp32.exe CABANAS.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CABANAS.exe