Analysis
- max time kernel
598s - max time network
603s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/10/2026, 10:58
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
600 seconds
General
- Target Payload.exe
- Size 55KB
- Sample261001-m233wsae98
- SHA256 f44154e85d5689f9735097cd8aad8a672e5d22c411d58621f022310bf121e185
- MD5 eaa6d1a8e6470af49d3a64ad661ba5e0
- SHA1 a186df196dd7f5c3ecb469a2cf8f667f99c89b10
- SHA512 a4b2edaecbdc07b08f4de8ca6ceb7762ba5ade691beeef4eb1f5ebf973ccc2552b43908a0230c22be8344b1669e0765dfe311ec9812ee689025d12808a16589a
- SSDEEP 1536:Qwjs4DnAN7jytFADKwsNMDHXExI3pmVm:7I4DnA2PADKwsNMDHXExI3pm
- TLSH T1DC432844BFEA4A01E2BD8F3469F555150A34BA63E532EB1F48D668DB13327C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Payload.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Payload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe Token: SeIncBasePriorityPrivilege 1308 Payload.exe Token: 33 1308 Payload.exe