cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe
Size 7.3MB
Sample261002-e82jmsvz9j
SHA256 cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335
MD5 6e83475d189ccad6d7722df30cea8ae6
SHA1 ce788bf8b8874e5e44d0163a3176ff92f45a2e78
SHA512 26fb966b60e1644298a85c8e9bd068e789022fc9902a5e979e6d1096cb735c0fe27feb9e2a1eead5a769f6ca39b8128e35ea34e9a99ce5a715450adde6627c65
SSDEEP 49152:h6pRhxvXoBADkCQxpLoLR87qllibjowGN04zooiYCbzzjN8l8r0tUHj/2JDdtQlZ:+xpt5D/T3jB70uChkubfg
TLSH
T17676C62A677960D9C17BC07892878F62BD2170D90B392BF344D1827A2F24EF96D3D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe
1792	cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe

C:\Users\Admin\AppData\Local\Temp\cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe
"C:\Users\Admin\AppData\Local\Temp\cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updates.json

Path C:\Users\Admin\AppData\Local\Temp\governor-update-preferences-1792-1790915856192470700-0\updates.json
Size 20B
SHA256 8f99292b617bbb5f2f15f17fc5d4d9df5b839f7a5b593cbacd8842fb69f37ce5
MD5 138b9d10b8bb1e8b8bb96a45a67e9046
SHA1 95c4d589311ac9b3ecf82c04de1d381e8c9452bb
SHA512 7cbc0e064ce0c62ea4329619e6df5e61d882919e63302cb5d39dab74d026d7a960c2d61107760b53ad1959ea03325089eda40de457f2dc78cc9bc85b819a24d7
MD5 SHA1 SHA512

Submit Download

updates.json.tmp

Path C:\Users\Admin\AppData\Local\Temp\governor-update-preferences-1792-1790915856192470700-0\updates.json.tmp
Size 19B
SHA256 7850de8e7684b48649545415c91a8fb5d970b6dae70a66e1f89ea28a51cacb01
MD5 9bc95d7e11124ef3fd43e8cb2f3c3714
SHA1 8528e96cfcd441ef51faf7b071595833d40ecf70
SHA512 58e0108663b834dd8183830dff13189e8e06613af9bc1a4e980658a23990f1053ccf158c3cec527310e5a25fc949dd2bab9dc1f8e3f3d1e36db9e23c7ebf113c
MD5 SHA1 SHA512

Submit Download