Analysis
- max time kernel
5s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/10/2026, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
بعيوني عبدالاله.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
بعيوني عبدالاله.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
بعيوني عبدالاله.exe
Resource
win11-20260911-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
بعيوني عبدالاله.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target بعيوني عبدالاله.exe
- Size 11KB
- Sample261016-3d4bracb22
- SHA256 210daf6400e66f348784c5f224fae120eafc9be75cb38438152790cc9023ca53
- MD5 0d20894b004a785daee8db3d214ee698
- SHA1 09a5009717773d14ec38324c465959c16b8e8fba
- SHA512 c1cb3b4aae08864e2435a2fdb2d7b891920ff0d22e805197dbd23a778576d18ba183460d25a191002225347a8b9dc1706a353363b23de175ba15517d78b3a894
- SSDEEP 192:twuCj48hXnWOJE3hfRLNHFd4Sqr9ozaGel6z0M:tf64IWOmdBRFCSQ9ozaPl6z0
- TLSH T10E323B06EFC68530CAEC0BB9A4771296A530F80E8F17DF5B2DDE04766EB57400E942D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies system executable filetype association 2 TTPs 34 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit reg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 972 cmd.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA0ED3C-B95D-490f-9C60-0FF3726C789A}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.dtcp-ip reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F058-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A56AF32-C21F-11DB-96FA-005056C00008}\Instance\PBDA DTFilter reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000009D-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.drf\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0244-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C9F8B73BF303523781852719CD9C700 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46E31370-3F7A-11CE-BED6-00AA00611080}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0082-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0248-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0355-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\.m2v\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002E158-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0141-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0086-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063034-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{070996BF-13E3-4008-86A9-DFA7AF5D5A27}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.RDP reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.srw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0031-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0079-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0045-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0164-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00006109C80000000100000000F01FEC\SourceList reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020803-0000-0000-C000-000000000046}\Conversion\Readable\Main reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.60.31203_x64\Dependents\{5625bb48-295c-4113-bc92-d6a69b19b04c} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002093F-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0326-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{305106DA-98B5-11CF-BB82-00AA00BDCE0B} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51973C41-CB0C-11D0-B5C9-00A0244A0E7A}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18A06B6B-2F3F-4e2b-A611-52BE631B2D22}\AuxUserType\2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE39F3D7-1B13-11D0-887F-00A0C90F2744}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0096-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0316-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6215E4B1-545A-406E-9824-0A5B5AC8AD21} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.iso reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.wri\PersistentHandler reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0257-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0340-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\ActivatableClassId\App.AppXagmtrxzz3btd8m1e51ke52affh42q70g.mca reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020899-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\.msix reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00030000-0000-0000-C000-000000000046}\TreatAs reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C100BED4-D33A-4a4b-BF23-BBEF4663D017} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0130-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020945-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0071-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0093-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244B6-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1440 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1440 AUDIODG.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1896 wrote to memory of 972 1896 بعيوني عبدالاله.exe 83 PID 972 wrote to memory of 1732 972 cmd.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\بعيوني عبدالاله.exe"C:\Users\Admin\AppData\Local\Temp\بعيوني عبدالاله.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\system32\reg.exereg delete HKCR /f3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1732
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440