Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/10/2026, 12:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
天刑版本.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 天刑版本.exe
- Size 4.0MB
- Sample261015-payefacv71
- SHA256 df28984cb3b7666d2116f9a7ac3871e30b13a60bdf4efb2475824bd70fb6102f
- MD5 9a410a512eec77c6524cabe0177871b5
- SHA1 1233589e580d607a4d8f2a225ac7eeb7d8c33494
- SHA512 f471c2cfa91a04f4dac4071a2b56ee32542798ac0c0892b2a256e367e7d2fe80c87bb92fe58ecd85f669dbf253bf17467f473af10bdef057444cbb4a41343e22
- SSDEEP 98304:geMiQg7u/hYOnFbBgKdn2dYfbZTvOLioRwNfpaEJY6VVYQK1S+LE29070CPNt:zv7uhYOFbBgK8yZTve0tVVYp3LPQ
- TLSH T128161201B69191F2C619057508ABE7B5EA7AAD024F20DFC35B58FE6D5D332C1EA3720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\Mslmedia.sys LMIns.exe File opened for modification C:\Windows\system32\DRIVERS\SETDEC2.tmp LMIns.exe File created C:\Windows\system32\DRIVERS\SETDEC2.tmp LMIns.exe File opened for modification C:\Windows\system32\DRIVERS\Mslmedia.sys LMIns.exe File opened for modification C:\Windows\system32\DRIVERS\SETB8EB.tmp LMIns.exe File created C:\Windows\system32\DRIVERS\SETB8EB.tmp LMIns.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation LMIns.exe Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation LMIns.exe - Executes dropped EXE 2 IoCs
pid Process 5276 LMIns.exe 3956 LMIns.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\_ntdll.bak LMIns.exe File opened for modification C:\Windows\_ntdll.bak LMIns.exe File opened for modification C:\Windows\hllog.txt LMIns.exe File created C:\Windows\Setupsti.log LMIns.exe File created C:\Windows\_ntdll.bak LMIns.exe File opened for modification C:\Windows\hllog.txt LMIns.exe File opened for modification C:\Windows\Setupsti.log LMIns.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5356 cmd.exe 1948 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 天刑版本.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMIns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMIns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4896 PING.EXE 464 PING.EXE - Runs ping.exe 1 TTPs 2 IoCs
pid Process 4896 PING.EXE 464 PING.EXE - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 5276 LMIns.exe Token: SeAssignPrimaryTokenPrivilege 5276 LMIns.exe Token: SeAuditPrivilege 5276 LMIns.exe Token: SeBackupPrivilege 5276 LMIns.exe Token: SeChangeNotifyPrivilege 5276 LMIns.exe Token: SeCreatePagefilePrivilege 5276 LMIns.exe Token: SeCreatePermanentPrivilege 5276 LMIns.exe Token: SeCreateTokenPrivilege 5276 LMIns.exe Token: SeIncBasePriorityPrivilege 5276 LMIns.exe Token: SeIncreaseQuotaPrivilege 5276 LMIns.exe Token: SeLoadDriverPrivilege 5276 LMIns.exe Token: SeLockMemoryPrivilege 5276 LMIns.exe Token: SeProfSingleProcessPrivilege 5276 LMIns.exe Token: SeRemoteShutdownPrivilege 5276 LMIns.exe Token: SeRestorePrivilege 5276 LMIns.exe Token: SeSecurityPrivilege 5276 LMIns.exe Token: SeShutdownPrivilege 5276 LMIns.exe Token: SeSystemEnvironmentPrivilege 5276 LMIns.exe Token: SeSystemProfilePrivilege 5276 LMIns.exe Token: SeSystemtimePrivilege 5276 LMIns.exe Token: SeTakeOwnershipPrivilege 5276 LMIns.exe Token: SeTcbPrivilege 5276 LMIns.exe Token: SeMachineAccountPrivilege 5276 LMIns.exe Token: SeDebugPrivilege 5276 LMIns.exe Token: SeDebugPrivilege 3956 LMIns.exe Token: SeAssignPrimaryTokenPrivilege 3956 LMIns.exe Token: SeAuditPrivilege 3956 LMIns.exe Token: SeBackupPrivilege 3956 LMIns.exe Token: SeChangeNotifyPrivilege 3956 LMIns.exe Token: SeCreatePagefilePrivilege 3956 LMIns.exe Token: SeCreatePermanentPrivilege 3956 LMIns.exe Token: SeCreateTokenPrivilege 3956 LMIns.exe Token: SeIncBasePriorityPrivilege 3956 LMIns.exe Token: SeIncreaseQuotaPrivilege 3956 LMIns.exe Token: SeLoadDriverPrivilege 3956 LMIns.exe Token: SeLockMemoryPrivilege 3956 LMIns.exe Token: SeProfSingleProcessPrivilege 3956 LMIns.exe Token: SeRemoteShutdownPrivilege 3956 LMIns.exe Token: SeRestorePrivilege 3956 LMIns.exe Token: SeSecurityPrivilege 3956 LMIns.exe Token: SeShutdownPrivilege 3956 LMIns.exe Token: SeSystemEnvironmentPrivilege 3956 LMIns.exe Token: SeSystemProfilePrivilege 3956 LMIns.exe Token: SeSystemtimePrivilege 3956 LMIns.exe Token: SeTakeOwnershipPrivilege 3956 LMIns.exe Token: SeTcbPrivilege 3956 LMIns.exe Token: SeMachineAccountPrivilege 3956 LMIns.exe Token: SeDebugPrivilege 3956 LMIns.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 天刑版本.exe 4820 天刑版本.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5276 4820 天刑版本.exe 86 PID 5276 wrote to memory of 1948 5276 LMIns.exe 88 PID 1948 wrote to memory of 4896 1948 cmd.exe 90 PID 4820 wrote to memory of 3956 4820 天刑版本.exe 99 PID 3956 wrote to memory of 5356 3956 LMIns.exe 101 PID 5356 wrote to memory of 464 5356 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\天刑版本.exe"C:\Users\Admin\AppData\Local\Temp\天刑版本.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\LMIns.exeC:\Users\Admin\AppData\Local\Temp\\LMIns.exe2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\PING.EXEC:\Windows\system32\ping.exe 127.0.0.1 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LMIns.exeC:\Users\Admin\AppData\Local\Temp\\LMIns.exe2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\PING.EXEC:\Windows\system32\ping.exe 127.0.0.1 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:464
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\LMIns.exe
- Size 1.1MB
- SHA256 8c5d78058c61e0526b40edb9539eafc9c96e01314c194fdf8e3deef7e9f1ab94
- MD5 733fe33190af80623ce169a45e256e9f
- SHA1 3e4fd717b3db9fc818dc39f69c8df57efc33808b
- SHA512 11f7c40cd6829bafede053a52812fcfef4c0a0cfbf9c56f63614080e5d3dc101fc0c157e561a95a260a4e82db0ae5a6e5e1e967c117d320836be434befa4d79b
- SSDEEP 24576:zmf5T3/qoNBmN0vyYhUr/nzlTYFcB+/QpY0aHuQW1FGr6Cr:yRTvfBDyTrn5TYE9VBVGr
- TLSH T18A350265BB81D462CC3A053285E3C7256335FD255BA19B83B28C7B3A9D731C1AA3734E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat
- Size 105B
- SHA256 8053a4e831da80017923db94850b01f4067bb2df7c244ee7793a26c55867af3f
- MD5 c3c336b3a4a32fd62efaaa57aa8ba0d8
- SHA1 7cfe430a437848e06a178ad008e7a39cd63b51dc
- SHA512 300fe233b6929e6554c23e8d504d9e116b861c0e8e3deff97a08d1aba53f4637266c2d9bbbdc77e06901c68893446e7c52f9903b393ba11eda39d0c7cf88dd22
- TLSH T157B0121243A68BF8C558457A652D551CC1BEF4C83A4013158D415086D05142DE656E60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~tmp_hl\mslmedia.inf
- Size 2KB
- SHA256 f9cd6291193aff10ae9cb791b06465113f74bc942e4b8160203f31e518466cbd
- MD5 9071fca2ed60ef5fb6980094c7011538
- SHA1 d2282e0908a979ef5383013b0b37281608da9478
- SHA512 cc9dcdec7f1d0358027ec8a46363e3605cbe47d20cd4c7eb1ea53bf2180e064aa72ecf713507daa3cbbb881dd42525273db55365f9770a79db90e961ebc2cfd2
- TLSH T16051BA888B978674F58B3264BF133843BA253164D0F9354076ED9198D396E1D83B0ABE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~tmp_hl\mslmedia.sys
- Size 22KB
- SHA256 1ba357a90c9215750a0fa94619a822c1778af6a5166afbefb9ebe18321c6e6ec
- MD5 05197941fcef6bcbcc6c72e7f691fe1c
- SHA1 e2897fcec1370e8ada3e6759180f1d312bfb5524
- SHA512 4b8525f609e00fa3e6983db5e5333be18388b952b345ee4c545fd6ee31fed0db84719d29bf9378da14523298c67e8657d98db01cdbabddce8b4baae414a96b08
- SSDEEP 384:a4uZoroAMebC1xFDlUHpPlSbtVFb0B9d0H5shWsid52RbBWtnW6dYLHizUHeMDkB:a4uon2DZUJcXFk/C5shWsoAEfd6HiBB
- TLSH T175A24C86876014A9E9EB8A35C1B1E72BE9B0F4958B7597CF4070C1A61E13FE4B77C306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Setupsti.log
- Size 1.1MB
- SHA256 1e974ac5b62e18a03f570abada4724d15b45a949109e03a2255eba6bb409c89c
- MD5 03705e9d9f3dda705f8e412b7848d77a
- SHA1 b4dae791978728e053ce0db280405368fac99b9d
- SHA512 04b422587369d2b1c076996c45206d6b5060ceba7bb7b22e16d8fb1b88dea58f13af932150660726f7c9984d54fbb4528cf3128b2ecb4db7ad8fc7893e3b1deb
- SSDEEP 24576:bYwghTXGLxYXCbePYvOjv5VE/rj7lubnOKh1VYtEQGJf8TVT93CDnDk:bYzhbGLxYXGePYGjv5VGrj7lubOKh1VI
- TLSH T12D35BF72A053D64C847AA6714CDD43D0B1563C24ABA860E77B66F31E22F51C2E9FBF12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\hllog.txt
- Size 84B
- SHA256 5732d9e1e2c4a47a1afd5c406a1187d4c2b311a436b7904f0eb988ff06a4ddea
- MD5 f5f1ca031e6d6dcc2e157a191b988017
- SHA1 96a12de179513e3985b95da17771ba83405431bd
- SHA512 3000a046352d4a8a462bab5950730d55c9a993eac825bdb8a362b1c000d2fa4ccfeee5ad507351246493c8f270077d3f90ad2e2b0711b0ea3f3ee82df511f001
- TLSH T181A012D05000C263D455314D00C048430C4B1001E00B6987ECC23099C98432E0129521
- MD5 SHA1 SHA512 TLSH