449438b41b213155444d0da11c270dea561322d89d06b181a8ad09a86da81bd8

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
madcausebad cracked.exe
Size 3.8MB
Sample261024-d4tskahv8m
SHA256 449438b41b213155444d0da11c270dea561322d89d06b181a8ad09a86da81bd8
MD5 0c6ada7da5c25a7b346b407d58730f75
SHA1 0c0b0033c9c7166c3d0eb09c0ec3abc74419f2f3
SHA512 a539c4de7745859aba002a2ccece46199fcdabfd26c7f06e408bc1d85f34811f60bc3fb8d4140066cebee17332f2b8d0b191918374c9f78c04868af8c7c79fb8
SSDEEP 49152:oXwV0MMbHgy4I9YnDvuHJZgkD0P4fITbl9nfq9smbYlo:aUBvIJ/Dy2IT5tbmbYl
TLSH
T17E06E046636EC1E8D92A813C54B66BC7B6F13D3DD3108FEF22D04CA81E9B6D15AB56C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rVpkBHMisYHGSfVsxbGBBfWyKVE\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\rVpkBHMisYHGSfVsxbGBBfWyKVE"	madcausebad cracked.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	madcausebad cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	madcausebad cracked.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	madcausebad cracked.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	madcausebad cracked.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	madcausebad cracked.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	madcausebad cracked.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4868	madcausebad cracked.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4868	madcausebad cracked.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	madcausebad cracked.exe
Token: SeLoadDriverPrivilege	4868	madcausebad cracked.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4868	madcausebad cracked.exe

C:\Users\Admin\AppData\Local\Temp\madcausebad cracked.exe
"C:\Users\Admin\AppData\Local\Temp\madcausebad cracked.exe"
1⤵
- Sets service image path in registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4868