Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe
- Size 2.4MB
- Sample260930-p3h58aff68
- SHA256 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8
- MD5 8b6aa61e56a74e1fd47f712311854c26
- SHA1 bcb00760a997d4598e6cfabd79dc0ac383d29bd9
- SHA512 d6fc51a724403199f54b415ea647a6a942a3fbf50a3b5cfb7c2e4c912484d6ab1c22f16d7745e2ad5867dd777fd7ab8a87d32bee65ca6d81224be133764a4f5e
- SSDEEP 24576:Qj6survyrdJRicWTOz47HMdwN12gWg1FNDf8FwPMlnz89WuqZ/npdBC6/Yzweyxq:w6IK/XIuIwZVfUYX5dusDKD4xHaf
- TLSH T13EC56C13E10184A1D5252AB026B6573DAE75AA720974CA43FFFCECF4AF73523C6A610D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: 33 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe Token: SeIncBasePriorityPrivilege 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe 4644 76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe"C:\Users\Admin\AppData\Local\Temp\76d92fd9fe2c909a2f0da9a7e4f34d91e4a172f23c7728c3f1be6072b7f242e8.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4644