947503df276fe9cb3ec2b5fd070812c42e3fd70443a3e383676121aad219d81f

Analysis

user interaction
yes
max time kernel
10s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 18:10

Target
tokenlogin.exe
Size 37.1MB
Sample260930-wsfexaxepc
SHA256 947503df276fe9cb3ec2b5fd070812c42e3fd70443a3e383676121aad219d81f
MD5 efa61c0e0092c65088105875cb5ef47c
SHA1 ecb70a692ea5f4d8b9c88fefa0cb0ba261c724da
SHA512 14c84280df9111bc2a86c3baf31579ad287a3136a471cd3b66b5b41a1f4a79f3506f644d549aeba1682d9adbd70fdf9dffb40639331a360337c99d65f5936c95
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfw:fMguj8Q4Vfv5qFTrYP
TLSH
T12F878B0773E60195E5B7D2388AA74107D773B4638331DADF329D06552FABAE09A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tokenlogin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tokenlogin.exe

C:\Users\Admin\AppData\Local\Temp\tokenlogin.exe
"C:\Users\Admin\AppData\Local\Temp\tokenlogin.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:1124

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact