fa9306aa6043a02e6a945ce988d60f4adc3da6eee265e78f32ad7c3771b7f0f7

Analysis

max time kernel
602s
max time network
343s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$RESOURCES/AACGUARD/AACGUARD/AAC.exe
Size 183.5MB
Sample261018-vbpftassbx
SHA256 fa9306aa6043a02e6a945ce988d60f4adc3da6eee265e78f32ad7c3771b7f0f7
MD5 c0f7648918ceacbc9c797c317f71193b
SHA1 67aab195c96b084069d362166c3a9fa5143dfd0d
SHA512 0ac1d56666df8a8236672d0e3ae77e11ca5b72b8ef8889601fd1d4a5b8df1dfcaa46b2e9c1f943eb3c67ac5e0311f27781309927209337f68b1ec7ec13229f3d
SSDEEP 1572864:s+Jjhd0zXulehSaq9XR7yLqp2iGLfztINXbCw9n6O8b:sgJ7aq9XR7yLgjGXtINdO
TLSH
T118988D02A3EC1A55E17BA6B4E6724692D6F0BC525721E1CF0484F90F2E77FD16A36332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AAC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe
5988	AAC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5988	AAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	AAC.exe
Token: SeDebugPrivilege	2032	AAC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5988	AAC.exe
5988	AAC.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5988	AAC.exe
5988	AAC.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 4708	5988	AAC.exe	89
PID 5988 wrote to memory of 2976	5988	AAC.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\$RESOURCES\AACGUARD\AACGUARD\AAC.exe
"C:\Users\Admin\AppData\Local\Temp\$RESOURCES\AACGUARD\AACGUARD\AAC.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN AACGuard
  2⤵
  PID:4708
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN AACGuard /XML C:\Users\Admin\AppData\Local\Temp\aacguard-task-17238638eb5f47108121abceb98c0149.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2976

C:\Users\Admin\AppData\Local\Temp\$RESOURCES\AACGUARD\AACGUARD\AAC.exe
C:\Users\Admin\AppData\Local\Temp\$RESOURCES\AACGUARD\AACGUARD\AAC.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aacguard-task-17238638eb5f47108121abceb98c0149.xml

Path C:\Users\Admin\AppData\Local\Temp\aacguard-task-17238638eb5f47108121abceb98c0149.xml
Size 3KB
SHA256 7fa76dc75d0f18d47c57b7175d07adfd033682df2c462a368d974205ed4c46b4
MD5 260f5af67c52190e565d19a4c2de5f37
SHA1 f11d03d84f438ba370aace0535b20b2a42b24ba0
SHA512 9a41e11fd7226e699c667158867d0c23efa93de8093a0048043c718cc43f1148eec20c7fca23634253b9b92ca3f82af5859c526fd49df00c56ecf97771ebf63a
TLSH
T16E61789367FE1109F2F76BACAFBB64418EA7BC585D35C46D01AC410D0FB3A228960736
MD5 SHA1 SHA512 TLSH

Submit Download