0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe

Analysis

user interaction
yes
max time kernel
1s
max time network
11s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/10/2026, 14:01

Target
HighHappy.exe
Size 82KB
Sample261002-rbpvssbf46
SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
MD5 788b0974f73acea93c7af807cbec1317
SHA1 8a5482beb542396efef378d2556698ba4aebf363
SHA512 487bab2035cef1a90f8c1f619af9b57784a4203b6291ef871db2340437f24184825ca931cb64f9fc58ebcc8b51e428f1261e8ff040cac2e919a285d00f8f1051
SSDEEP 1536:KahfyS/+TAODerDpbuEpPEUwsbuUrVzBq05j9aJggFSoHdduVm0A9SBwwVcl:KahfyS/+TAODer9bFpPEobbxN5M2gFSM
TLSH
T1F283A1557394E65AC4231735D991D3F4A730DD85EA46C34B36E8BE2B3EBD2E28E412C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	HighHappy.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	HighHappy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3876	cmd.exe
3836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HighHappy.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3560	HighHappy.exe
Token: SeDebugPrivilege	3560	HighHappy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3876	3560	HighHappy.exe	84
PID 3560 wrote to memory of 3836	3560	HighHappy.exe	86
PID 3560 wrote to memory of 2452	3560	HighHappy.exe	87
PID 3836 wrote to memory of 3968	3836	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\HighHappy.exe
"C:\Users\Admin\AppData\Local\Temp\HighHappy.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C vssadmin delete shadows /for=C: /all
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKCR /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /s /q "C:\Windows\System32"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452