4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe
Size 6.4MB
Sample261002-e857tsvfkb
SHA256 4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32
MD5 3e858f2681ea9440fb04e50c08c7b9f4
SHA1 b231ea2bcb059b27712531aa5b969eae1d2294f0
SHA512 42746a15b7bd521deb5c171692a9a2af55855458e4ad3caff2265c38db9aee5b736fd0de8d7b52cb3d4e93ea51e3e3666b7ae9573a46d0ec1438bcf6eeb6ee2f
SSDEEP 49152:F1Ta7vBYEO7dnvbswR6QodleC5Ei4ljLsY+jV9VvA6X0aV0SViIeaDp1D/UUxjud:ijJ1zEZgxv7S/Nugv
TLSH
T16566C626A77960D9D17FC07892879F62BD2070D907392BF34991827A2F24EF8AD3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe
1648	4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe

C:\Users\Admin\AppData\Local\Temp\4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe
"C:\Users\Admin\AppData\Local\Temp\4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updates.json

Path C:\Users\Admin\AppData\Local\Temp\governor-update-preferences-1648-1790915869104782100-0\updates.json
Size 20B
SHA256 8f99292b617bbb5f2f15f17fc5d4d9df5b839f7a5b593cbacd8842fb69f37ce5
MD5 138b9d10b8bb1e8b8bb96a45a67e9046
SHA1 95c4d589311ac9b3ecf82c04de1d381e8c9452bb
SHA512 7cbc0e064ce0c62ea4329619e6df5e61d882919e63302cb5d39dab74d026d7a960c2d61107760b53ad1959ea03325089eda40de457f2dc78cc9bc85b819a24d7
MD5 SHA1 SHA512

Submit Download

updates.json.tmp

Path C:\Users\Admin\AppData\Local\Temp\governor-update-preferences-1648-1790915869104782100-0\updates.json.tmp
Size 19B
SHA256 7850de8e7684b48649545415c91a8fb5d970b6dae70a66e1f89ea28a51cacb01
MD5 9bc95d7e11124ef3fd43e8cb2f3c3714
SHA1 8528e96cfcd441ef51faf7b071595833d40ecf70
SHA512 58e0108663b834dd8183830dff13189e8e06613af9bc1a4e980658a23990f1053ccf158c3cec527310e5a25fc949dd2bab9dc1f8e3f3d1e36db9e23c7ebf113c
MD5 SHA1 SHA512

Submit Download