2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Size 1.0MB
Sample261017-m6vx3sstdt
SHA256 2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0
MD5 0675a95458435e1b2592f255d5dce2f9
SHA1 681eea199dcaef6bfb7677cde9e201cd8f9157a9
SHA512 1447297044d83bfb9f926b75f5f72674c6f559987c5ff77fba4770e155178f62105c90070fd7b1d494b5f5b18002119c3605a839784103a152cbd7fba2222ac3
SSDEEP 24576:XTRRgkObgBSIiZOWrkjRz0Cvx5CpEUv8YGkK3vPd2Pg6ZPk:XTznniDMroRDK3v1OXt
TLSH
T1F83533721F34A623CDC355BF7FB25EAED0269D43257A472563EE4CC4B827288D6B5082
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2124	sg.tmp
792	priprinter.pro-patch.exe

Loads dropped DLL 1 IoCs

pid	Process
792	priprinter.pro-patch.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2532-0-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral2/memory/4312-8-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral2/memory/2532-48-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral2/memory/4316-50-0x0000000000400000-0x000000000056C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe
5116	cmd.exe
2712	cmd.exe
696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	priprinter.pro-patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2868	taskkill.exe
4740	taskkill.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeBackupPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeBackupPrivilege	4312	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	4312	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	4312	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	4312	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	2124	sg.tmp
Token: 35	2124	sg.tmp
Token: SeSecurityPrivilege	2124	sg.tmp
Token: SeSecurityPrivilege	2124	sg.tmp
Token: 33	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: 33	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeBackupPrivilege	4316	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	4316	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	4316	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	4316	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4832	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	89
PID 2532 wrote to memory of 4312	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	91
PID 2532 wrote to memory of 2124	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	92
PID 2532 wrote to memory of 5116	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	94
PID 5116 wrote to memory of 2868	5116	cmd.exe	96
PID 5116 wrote to memory of 4740	5116	cmd.exe	98
PID 5116 wrote to memory of 2712	5116	cmd.exe	99
PID 2712 wrote to memory of 2420	2712	cmd.exe	100
PID 5116 wrote to memory of 5696	5116	cmd.exe	101
PID 5116 wrote to memory of 5296	5116	cmd.exe	102
PID 5116 wrote to memory of 1088	5116	cmd.exe	103
PID 5116 wrote to memory of 792	5116	cmd.exe	104
PID 2532 wrote to memory of 4316	2532	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	106
PID 4316 wrote to memory of 696	4316	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	107

C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
"C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1020928 -len=60695 "C:\Users\Admin\AppData\Local\Temp\~3630750061718749291.tmp",,C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Users\Admin\AppData\Local\Temp\~6104049061422623462~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~3630750061718749291.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~564319340682680668"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~564319340682680668\pripath.cmd""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM priPrinter.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im pritray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe query "HKCU\Software\Pelikan Software KFT\priPrinter" /ve
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\system32\reg.exe
      Reg.exe query "HKCU\Software\Pelikan Software KFT\priPrinter" /ve
      4⤵
      PID:2420
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Pelikan Software KFT\priPrinter\reg" /v "key" /t REG_SZ /d "LLU65CFE11W04WJF454QF8QF2DJW5U3NZL0000006Z1J1WL3JNF2GSAQJ3FWGN04EF000000#999" /f
    3⤵
    PID:5696
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Pelikan Software KFT\priPrinter\reg" /v "user" /t REG_SZ /d "[email protected]" /f
    3⤵
    PID:5296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo."
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\~564319340682680668\priprinter.pro-patch.exe
    priprinter.pro-patch.exe /silent /overwrite /startupworkdir:""
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:792
- C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~6513408668352895563.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~6513408668352895563.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dup2patcher.dll

Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 56KB
SHA256 354acda1219410085896e42039a5611d867a608b3c1b7699afd241449f32f644
MD5 4a5fa04d56773a2945572a71ab0e95a1
SHA1 64002b9d189bd8739b68abcdce9e742418a19866
SHA512 ec86d5b285b8a969e91f0232f109e9968a3b2cb7bd4366b82052fa06787c945a99b48fe3756296ea7739ec04e56644a43527cac1882e5a4723f6a4e5b891e22f
SSDEEP 768:5dqDhNM0fB5eI+X4BoePeye6eyeqeSeaege6Rsllp8ZQhdokI:YNTilc2ldltF9j6RW8ChdRI
TLSH
T16B43E6586D5B86BDC34047352CD99E6086785F31E650E113AF3C2E2C2F25A93EB2BD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~3630750061718749291.tmp

Path C:\Users\Admin\AppData\Local\Temp\~3630750061718749291.tmp
Size 59KB
SHA256 5ecb1cf257a8cf0da0c2364acd1a228d960f70cadaab1b3004d7b8bb393e4c96
MD5 17f0656066f12573ae95570d9c626fb8
SHA1 103ceb098af00c227fcff30ab2af06a75814b2b7
SHA512 a39dd25f411198fffb5e65569254bddf3c774bfa2f07f2d2f085bfac72bdf38677ebe76e00915d5506856c14e1b68bf2b1d7455342e3b37cd4c41b54a00e62cf
SSDEEP 768:hjwP0pBVSwx/uvuPBDUyL8Daw3nyGmRCAd0wO2cEqOpz6n0tIq8HiuEeV2CJ7fd:B40pjbx/zDUyL2PPmMq+E5h6n0t5uEwf
TLSH
T19553028620126DF84F2FB4BFC2B9EFCD57012D43416C92965F06FD889B0659C6BAD42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pripath.cmd

Path C:\Users\Admin\AppData\Local\Temp\~564319340682680668\pripath.cmd
Size 651B
SHA256 500548ccbb4714613b24855f2fc0fac435f29c136227cd839346d0f2b6cd1d0c
MD5 da78eb30c21af12a42e8488a98bbf9b0
SHA1 41b1016e2718986f58e127ed58d63323cbab29f2
SHA512 f0e71bceefe8096586cfdd1f3b3fd879f1c40353f89b3a36f2d9d1fb98f3c32ba405eec6c2db456c12f8c6c1e7d81391a7b5347daef09d8e3dd660692317ea20
TLSH
T1F4F0F941341F2920D48006B6C727210AAEBFFBCA9EF01BC13339B09E202300098383EE
MD5 SHA1 SHA512 TLSH

Submit Download

priprinter.pro-patch.exe

Path C:\Users\Admin\AppData\Local\Temp\~564319340682680668\priprinter.pro-patch.exe
Size 62KB
SHA256 30aba08cc3234ac4d446320cfa430c09fb37dadf1b0d1b6e132fa0ca50f04c1b
MD5 2fd8e4f6cd945a76d2e8539288aa6e6b
SHA1 10a570cb0cde59a9b93c5c99801e6a08e2c26e9d
SHA512 c29af44b536e2bc660d535c75df5174714edb2173ab05f42db2bf5498927bf261869f2bcb91f15d769b5a921a2fe1de1fb5bc5255130c73fb53afa2120c9e6c0
SSDEEP 1536:n1pG4kHYksunkd3oTE3/cC4hC+YHTu90gf30a20JC:/T8nkBhoC+YHTuDcG
TLSH
T12253F115B28705DFD25CCC7347979DF4BF7A9C5B60712A5AB3C92B680F232AAC15103A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~6104049061422623462~\sg.tmp
Size 829KB
SHA256 d735780f64cc6d1b98fdf737eb1117d07ddc65777df1843742a8c7e2295f2d8b
MD5 bc57ce177a5f3d52dbccd96498b7e0a6
SHA1 e499f4a51c7c82e1edd8b96ba17df1d779267cf4
SHA512 841f8112eb46883a32264694096bdb06d2877f7337a7e781905797d23d2a5657371454d777829e4a0523d262a48cd9794d13db2b51ec0bb49f2fc8797601d4b5
SSDEEP 24576:a9wBv4Tg0Jf6RazsshjFm/OJv5PkjZLmkMhgT92:a9g4lf6ATJQOb+iB
TLSH
T13005AF227BE5D0BBC24201318B1D7BF581F993680B2148C767908F6D7F359D6DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~6513408668352895563.cmd

Path C:\Users\Admin\AppData\Local\Temp\~6513408668352895563.cmd
Size 370B
SHA256 e1c7909e055fbf4e40fd3a9f3a3f05dfaec6e412366320282399b3976f324f43
MD5 efbd20a7010cdca241fcf4de2c6ae3a6
SHA1 1efed54900c4c8c007032d576471f77ecedd0ec1
SHA512 982fea8f06a782ee03ea629f402676ca7a4996d802f14a15204cc83e33d7cf6bccb3416d73610117a5a32fdb6b7114942017386b86a6c39126f3d0c397dd021a
TLSH
T123E0687374825FDF0D1038F705EA908CE199DC261F49BBD442B1107838736889DDAACA
MD5 SHA1 SHA512 TLSH

Submit Download

~~3349441176335252778.tmp

Path C:\Users\Admin\AppData\Local\Temp\~~3349441176335252778.tmp
Size 134B
SHA256 fc627800b37568d335b3b9cb61bedd6b5a5830f30b8b83395ff7fd13fb2c1d6d
MD5 b06973d4b2358f6f1f62cd52cd97d019
SHA1 e03ceeef6b050aed5d092d4fbc7ac8ffb06af935
SHA512 747abac5ad0ba54b509d760c60acd6446acf768d7b5719866f8fbc6c84922e82c7e6dc5164306dd86f4f2823122e9188d68c17c2670664ef6b1f2c4783fe33aa
TLSH
T191C02B503C32CA285C832EC280C2F6E41F2BC21680B141578B21986506513EE01B80C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-33-0x0000000073920000-0x0000000073946000-memory.dmp

Download

memory/2532-0-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2532-48-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/4312-8-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/4316-50-0x0000000000400000-0x000000000056C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads