Analysis
- max time kernel
900s - max time network
904s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 20:51
Behavioral task
behavioral1
Sample
673.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
900 seconds
General
- Target 673.exe
- Size 55KB
- Sample260929-znf3esfb45
- SHA256 9bd9e0269098e114fcc393c1ddc158ab004bffab48d3852c18cdc9458011115b
- MD5 b15a7fd96a2e79cc8a8e1830a5b508d2
- SHA1 d3d1f946d46d377a4d2ac63e954af0108dc54c21
- SHA512 0fbcb28a07fd8869edc8e2f5a2c999c258e8772cb173d8a30cc06bbdc954903822ab24fd7a5e763215615bd66ef1e21f5d3ddbed66c99151ed090328d302f2f5
- SSDEEP 768:QTDyFut1MankI2N9hi8QR3Q0kSNXmwFvfu0YMDHPsHL7XJSxI3pmim:QTy8Dn2N9hi8KdD2wsNMDKXExI3pmim
- TLSH T18D432844BFEA4A01E2BC8F7468F655150674BA23E532EB1F48D668DB17327C58C80FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 0.tcp.in.ngrok.io - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 673.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 673.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 673.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 673.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe Token: SeIncBasePriorityPrivilege 2580 673.exe Token: 33 2580 673.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\673.exe"C:\Users\Admin\AppData\Local\Temp\673.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5112
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5712