df28984cb3b7666d2116f9a7ac3871e30b13a60bdf4efb2475824bd70fb6102f

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
天刑版本.exe
Size 4.0MB
Sample261015-payefacv71
SHA256 df28984cb3b7666d2116f9a7ac3871e30b13a60bdf4efb2475824bd70fb6102f
MD5 9a410a512eec77c6524cabe0177871b5
SHA1 1233589e580d607a4d8f2a225ac7eeb7d8c33494
SHA512 f471c2cfa91a04f4dac4071a2b56ee32542798ac0c0892b2a256e367e7d2fe80c87bb92fe58ecd85f669dbf253bf17467f473af10bdef057444cbb4a41343e22
SSDEEP 98304:geMiQg7u/hYOnFbBgKdn2dYfbZTvOLioRwNfpaEJY6VVYQK1S+LE29070CPNt:zv7uhYOFbBgK8yZTve0tVVYp3LPQ
TLSH
T128161201B69191F2C619057508ABE7B5EA7AAD024F20DFC35B58FE6D5D332C1EA3720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\Mslmedia.sys	LMIns.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET66FD.tmp	LMIns.exe
File created	C:\Windows\system32\DRIVERS\SET66FD.tmp	LMIns.exe
File opened for modification	C:\Windows\system32\DRIVERS\Mslmedia.sys	LMIns.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET8B5E.tmp	LMIns.exe
File created	C:\Windows\system32\DRIVERS\SET8B5E.tmp	LMIns.exe

Executes dropped EXE 3 IoCs

pid	Process
1896	LMIns.exe
4392	Mslmedia.sys
2480	LMIns.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\_ntdll.bak	LMIns.exe
File opened for modification	C:\Windows\hllog.txt	LMIns.exe
File opened for modification	C:\Windows\Setupsti.log	LMIns.exe
File created	C:\Windows\_ntdll.bak	LMIns.exe
File opened for modification	C:\Windows\hllog.txt	LMIns.exe
File created	C:\Windows\Setupsti.log	LMIns.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1680	cmd.exe
4852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	天刑版本.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4912	PING.EXE
1056	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4912	PING.EXE
1056	PING.EXE

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	LMIns.exe
Token: SeAssignPrimaryTokenPrivilege	1896	LMIns.exe
Token: SeAuditPrivilege	1896	LMIns.exe
Token: SeBackupPrivilege	1896	LMIns.exe
Token: SeChangeNotifyPrivilege	1896	LMIns.exe
Token: SeCreatePagefilePrivilege	1896	LMIns.exe
Token: SeCreatePermanentPrivilege	1896	LMIns.exe
Token: SeCreateTokenPrivilege	1896	LMIns.exe
Token: SeIncBasePriorityPrivilege	1896	LMIns.exe
Token: SeIncreaseQuotaPrivilege	1896	LMIns.exe
Token: SeLoadDriverPrivilege	1896	LMIns.exe
Token: SeLockMemoryPrivilege	1896	LMIns.exe
Token: SeProfSingleProcessPrivilege	1896	LMIns.exe
Token: SeRemoteShutdownPrivilege	1896	LMIns.exe
Token: SeRestorePrivilege	1896	LMIns.exe
Token: SeSecurityPrivilege	1896	LMIns.exe
Token: SeShutdownPrivilege	1896	LMIns.exe
Token: SeSystemEnvironmentPrivilege	1896	LMIns.exe
Token: SeSystemProfilePrivilege	1896	LMIns.exe
Token: SeSystemtimePrivilege	1896	LMIns.exe
Token: SeTakeOwnershipPrivilege	1896	LMIns.exe
Token: SeTcbPrivilege	1896	LMIns.exe
Token: SeMachineAccountPrivilege	1896	LMIns.exe
Token: SeDebugPrivilege	1896	LMIns.exe
Token: SeDebugPrivilege	2480	LMIns.exe
Token: SeAssignPrimaryTokenPrivilege	2480	LMIns.exe
Token: SeAuditPrivilege	2480	LMIns.exe
Token: SeBackupPrivilege	2480	LMIns.exe
Token: SeChangeNotifyPrivilege	2480	LMIns.exe
Token: SeCreatePagefilePrivilege	2480	LMIns.exe
Token: SeCreatePermanentPrivilege	2480	LMIns.exe
Token: SeCreateTokenPrivilege	2480	LMIns.exe
Token: SeIncBasePriorityPrivilege	2480	LMIns.exe
Token: SeIncreaseQuotaPrivilege	2480	LMIns.exe
Token: SeLoadDriverPrivilege	2480	LMIns.exe
Token: SeLockMemoryPrivilege	2480	LMIns.exe
Token: SeProfSingleProcessPrivilege	2480	LMIns.exe
Token: SeRemoteShutdownPrivilege	2480	LMIns.exe
Token: SeRestorePrivilege	2480	LMIns.exe
Token: SeSecurityPrivilege	2480	LMIns.exe
Token: SeShutdownPrivilege	2480	LMIns.exe
Token: SeSystemEnvironmentPrivilege	2480	LMIns.exe
Token: SeSystemProfilePrivilege	2480	LMIns.exe
Token: SeSystemtimePrivilege	2480	LMIns.exe
Token: SeTakeOwnershipPrivilege	2480	LMIns.exe
Token: SeTcbPrivilege	2480	LMIns.exe
Token: SeMachineAccountPrivilege	2480	LMIns.exe
Token: SeDebugPrivilege	2480	LMIns.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	天刑版本.exe
4928	天刑版本.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1896	4928	天刑版本.exe	90
PID 1896 wrote to memory of 1680	1896	LMIns.exe	91
PID 1680 wrote to memory of 4912	1680	cmd.exe	93
PID 4928 wrote to memory of 2480	4928	天刑版本.exe	96
PID 2480 wrote to memory of 4852	2480	LMIns.exe	97
PID 4852 wrote to memory of 1056	4852	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\天刑版本.exe
"C:\Users\Admin\AppData\Local\Temp\天刑版本.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\LMIns.exe
  C:\Users\Admin\AppData\Local\Temp\\LMIns.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\SysWOW64\PING.EXE
      C:\Windows\system32\ping.exe 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4912
- C:\Users\Admin\AppData\Local\Temp\LMIns.exe
  C:\Users\Admin\AppData\Local\Temp\\LMIns.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SysWOW64\PING.EXE
      C:\Windows\system32\ping.exe 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1056

C:\Windows\system32\DRIVERS\Mslmedia.sys
system32\DRIVERS\Mslmedia.sys
1⤵
- Executes dropped EXE
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LMIns.exe

Path C:\Users\Admin\AppData\Local\Temp\LMIns.exe
Size 1.1MB
SHA256 8c5d78058c61e0526b40edb9539eafc9c96e01314c194fdf8e3deef7e9f1ab94
MD5 733fe33190af80623ce169a45e256e9f
SHA1 3e4fd717b3db9fc818dc39f69c8df57efc33808b
SHA512 11f7c40cd6829bafede053a52812fcfef4c0a0cfbf9c56f63614080e5d3dc101fc0c157e561a95a260a4e82db0ae5a6e5e1e967c117d320836be434befa4d79b
SSDEEP 24576:zmf5T3/qoNBmN0vyYhUr/nzlTYFcB+/QpY0aHuQW1FGr6Cr:yRTvfBDyTrn5TYE9VBVGr
TLSH
T18A350265BB81D462CC3A053285E3C7256335FD255BA19B83B28C7B3A9D731C1AA3734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lm_delself_.bat

Path C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat
Size 105B
SHA256 8053a4e831da80017923db94850b01f4067bb2df7c244ee7793a26c55867af3f
MD5 c3c336b3a4a32fd62efaaa57aa8ba0d8
SHA1 7cfe430a437848e06a178ad008e7a39cd63b51dc
SHA512 300fe233b6929e6554c23e8d504d9e116b861c0e8e3deff97a08d1aba53f4637266c2d9bbbdc77e06901c68893446e7c52f9903b393ba11eda39d0c7cf88dd22
TLSH
T157B0121243A68BF8C558457A652D551CC1BEF4C83A4013158D415086D05142DE656E60
MD5 SHA1 SHA512 TLSH

Submit Download

mslmedia.inf

Path C:\Users\Admin\AppData\Local\Temp\~tmp_hl\mslmedia.inf
Size 2KB
SHA256 f9cd6291193aff10ae9cb791b06465113f74bc942e4b8160203f31e518466cbd
MD5 9071fca2ed60ef5fb6980094c7011538
SHA1 d2282e0908a979ef5383013b0b37281608da9478
SHA512 cc9dcdec7f1d0358027ec8a46363e3605cbe47d20cd4c7eb1ea53bf2180e064aa72ecf713507daa3cbbb881dd42525273db55365f9770a79db90e961ebc2cfd2
TLSH
T16051BA888B978674F58B3264BF133843BA253164D0F9354076ED9198D396E1D83B0ABE
MD5 SHA1 SHA512 TLSH

Submit Download

mslmedia.sys

Path C:\Users\Admin\AppData\Local\Temp\~tmp_hl\mslmedia.sys
Size 22KB
SHA256 1ba357a90c9215750a0fa94619a822c1778af6a5166afbefb9ebe18321c6e6ec
MD5 05197941fcef6bcbcc6c72e7f691fe1c
SHA1 e2897fcec1370e8ada3e6759180f1d312bfb5524
SHA512 4b8525f609e00fa3e6983db5e5333be18388b952b345ee4c545fd6ee31fed0db84719d29bf9378da14523298c67e8657d98db01cdbabddce8b4baae414a96b08
SSDEEP 384:a4uZoroAMebC1xFDlUHpPlSbtVFb0B9d0H5shWsid52RbBWtnW6dYLHizUHeMDkB:a4uon2DZUJcXFk/C5shWsoAEfd6HiBB
TLSH
T175A24C86876014A9E9EB8A35C1B1E72BE9B0F4958B7597CF4070C1A61E13FE4B77C306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setupsti.log

Path C:\Windows\Setupsti.log
Size 1.1MB
SHA256 a84cdb5ce6134e69fe33fbfd803f51f0ed598e4c84cbe8c44c256b2277de9424
MD5 5659948a422c2e76c46a498956e9490a
SHA1 1d35093a9ab881ebb02410081c7b4614367ac2bc
SHA512 157ed2511239ed2b196b1cf50d3b7ba5ba5adf0bf08b3eabfde9d78e7f18332b52201fe011756dbc1b9ca5ff6d7fb06aee8cff7c46080b4c090be23a78dfa00a
SSDEEP 24576:bYwghTXGLxYXCbePYvOjv5VE/rj7lubnOKh1VYtEQGJf8TVT93CDnDf:bYzhbGLxYXGePYGjv5VGrj7lubOKh1Vz
TLSH
T18635BF72A053D64C847AA6714CDD43D0B1563C24ABA860E77B66F31E22F51C2E9FBF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hllog.txt

Path C:\Windows\hllog.txt
Size 84B
SHA256 5732d9e1e2c4a47a1afd5c406a1187d4c2b311a436b7904f0eb988ff06a4ddea
MD5 f5f1ca031e6d6dcc2e157a191b988017
SHA1 96a12de179513e3985b95da17771ba83405431bd
SHA512 3000a046352d4a8a462bab5950730d55c9a993eac825bdb8a362b1c000d2fa4ccfeee5ad507351246493c8f270077d3f90ad2e2b0711b0ea3f3ee82df511f001
TLSH
T181A012D05000C263D455314D00C048430C4B1001E00B6987ECC23099C98432E0129521
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-28-0x0000000000D40000-0x0000000000D9C000-memory.dmp

Download

memory/2480-56-0x0000000000D40000-0x0000000000D9C000-memory.dmp

Download

memory/4392-31-0x0000000000010000-0x000000000001A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads