8ffb19f3d236e0ba16c3b1775ddb2acc6bdd855e1f7cd12f2a23b88f5da4f505

Analysis

user interaction
yes
max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cbjnhacpacdhkmdinplh.exe
Size 1.6MB
Sample260929-wdvw2szelb
SHA256 8ffb19f3d236e0ba16c3b1775ddb2acc6bdd855e1f7cd12f2a23b88f5da4f505
MD5 5a86f4cc26308d54756dce682a16b144
SHA1 8ffaeea5ece9370516c4c4442d03510ab49f1e10
SHA512 6c703d04e25c28e1605799af6fea3a26d48d0a1dfe08a7375190be07fb7134b5bb8d3b37f2bbd5b1514aee2e1f570fafd0c5a7f688660d42ba8e8ba03893d7fe
SSDEEP 49152:fFsB23aqyyOaid/i+Q5KQzLn4vI4qxATU1TDk4:fFsk33C/8H4g4Fr
TLSH
T10A8512A565C62DB4C427DBF09162377EB029FB00CA7A5F0B7AD8ED018E53688F436746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cbjnhacpacdhkmdinplh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cbjnhacpacdhkmdinplh.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh	cbjnhacpacdhkmdinplh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh\ = "URL:cbjnhacpacdhkmdinplh Protocol"	cbjnhacpacdhkmdinplh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh\URL Protocol	cbjnhacpacdhkmdinplh.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh\shell\open\command	cbjnhacpacdhkmdinplh.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh\shell	cbjnhacpacdhkmdinplh.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh\shell\open	cbjnhacpacdhkmdinplh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\cbjnhacpacdhkmdinplh\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\cbjnhacpacdhkmdinplh.exe\" \"%1\""	cbjnhacpacdhkmdinplh.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1196	cbjnhacpacdhkmdinplh.exe

C:\Users\Admin\AppData\Local\Temp\cbjnhacpacdhkmdinplh.exe
"C:\Users\Admin\AppData\Local\Temp\cbjnhacpacdhkmdinplh.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: RenamesItself
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x00007FF6AFCA0000-0x00007FF6AFF54000-memory.dmp

Download

memory/1196-3-0x00007FF6AFCA0000-0x00007FF6AFF54000-memory.dmp