3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d

Resubmissions

12/10/2026, 23:36

261012-3lp44aszbw

12/10/2026, 23:30

261012-3hda5afc527

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe
Size 192KB
Sample261012-3hda5afc52
SHA256 3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d
MD5 39bf48682793069ecca03d4eef46ecac
SHA1 edc0a959b659659717af06157407015771f68bf5
SHA512 7c98007283f55c1d4216c2033526920cec8896d7f4a1c7df50650a43bab9df7f4c3f6549241810213915a93fbe6e5c5d3eb1465b66bed092dd663fddcb6c2e2b
SSDEEP 3072:AKvTOrKzbLOVyiRBKXu79eIsunG1zgMl8UXrhQcgx/:AKHGyTw9eZuG1Fl8irfgx/
TLSH
T1C714D52AF31BD0F8DD2764B2650BE2E76DFC7F018810AD4DCF455C19B929D1B0A24A69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4624	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
4916	TimeManager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Time Manager = "C:\\ProgramData\\TimeManager.exe"	explorer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TimeManager.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	explorer.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe
4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4624	explorer.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe
Token: SeShutdownPrivilege	4624	explorer.exe
Token: SeCreatePagefilePrivilege	4624	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4116 wrote to memory of 4624	4116	3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe	82
PID 4624 wrote to memory of 3256	4624	explorer.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Deletes itself
- Adds Run key to start application
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe
  "C:\Users\Admin\AppData\Local\Temp\3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4116

C:\ProgramData\TimeManager.exe
C:\ProgramData\TimeManager.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TimeManager.exe

Path C:\ProgramData\TimeManager.exe
Size 192KB
SHA256 613df49969f226bf3ab7ba7ac186ff1b8741f819a244a36cbef35177a018cf4d
MD5 6260f7d6984943790a0ca67f564b34b7
SHA1 926c0e86cea9f98b4026654283924fd746b38dba
SHA512 43091b61ccee6e7025b8053eff8c8f5df9145a4985f026ee670248363ec499b9c94b1db311e1504f5f178921a2fd81435dc4dc578d019db0608a7288e146ef92
SSDEEP 3072:TKvTOrKzbLOVyiRBKXu79eIsunG1zgMl8UXrhQcgx/:TKHGyTw9eZuG1Fl8irfgx/
TLSH
T1F714D52AF31BD0F8DD2764B2650BE2E76DFC7F018810AE4DCF455C19B929D1B0A24A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4116-1-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download

memory/4116-3-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4624-0-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4624-4-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4624-2-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4624-10-0x0000000002E00000-0x0000000002E01000-memory.dmp

Download

memory/4624-17-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4624-16-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4624-15-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4624-19-0x0000000002CC0000-0x0000000002CD9000-memory.dmp

Download

memory/4916-13-0x0000000000400000-0x0000000000433000-memory.dmp

Download