Analysis
- user interaction
yes - max time kernel
10s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/10/2026, 12:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HighHappy.exe
Resource
win11-20260911-en
windows11-21h2-x64
12 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target HighHappy.exe
- Size 82KB
- Sample261024-pdsy5atzev
- SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
- MD5 788b0974f73acea93c7af807cbec1317
- SHA1 8a5482beb542396efef378d2556698ba4aebf363
- SHA512 487bab2035cef1a90f8c1f619af9b57784a4203b6291ef871db2340437f24184825ca931cb64f9fc58ebcc8b51e428f1261e8ff040cac2e919a285d00f8f1051
- SSDEEP 1536:KahfyS/+TAODerDpbuEpPEUwsbuUrVzBq05j9aJggFSoHdduVm0A9SBwwVcl:KahfyS/+TAODer9bFpPEobbxN5M2gFSM
- TLSH T1F283A1557394E65AC4231735D991D3F4A730DD85EA46C34B36E8BE2B3EBD2E28E412C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Disables Task Manager via registry modification
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies system executable filetype association 2 TTPs 34 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command reg.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 HighHappy.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5544 cmd.exe 5452 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HighHappy.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.MOD\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.tli reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.BioEnrollment_10.0.19586.1000_neutral__cw5n1h2txyewy reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\.psm1\OpenWithProgids reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Print reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Application reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{048EB43E-2059-422F-95E0-557DA96038AF} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.XLL\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18987285-971B-4C88-AEA9-2A5600861BA5}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.au\OpenWithProgIds reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\.fh reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\PropertySheetHandlers\{7EFA68C6-086B-43e1-A2D2-55A113531240} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA7BAE71-FB3B-11CD-A903-00AA00510EA3}\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\opennew\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C282417B-2662-44B8-8A94-3BFF61C50900}\AuxUserType\2 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Windows.ContentDeliveryManager_10.0.22000.1_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\App.AppXyvyv4mghdjas8j88def reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0330-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.odt\OpenWithList reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.stm reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.wdp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020906-0000-0000-C000-000000000046}\DataFormats\GetSet\2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305106C2-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\AddToPlaylistVLC\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Addin\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.ChartApplication reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\ActivatableClassId\Windows.Networking.ContentPrefetcher.Internal.Con reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305106E8-98B5-11CF-BB82-00AA00BDCE0B} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\provtool.exe\SupportedTypes reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC529B00-1A1F-11D1-BAD9-00609744111A}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivatableClassId\App reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\.adt reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{687529e6-4d36-4336-88ea-94b03d16aa4b} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0002E11A-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.fif reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.z reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\.3g2\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\.crw reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\.ogm reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020818-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\Control reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020906-0000-0000-C000-000000000046}\Verb\0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC860C1A-CD41-4AA4-AC8E-75ABB7B46E21}\InProcServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\PlayWithVLC reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivatableClassId reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ppam\ShellEx\PropertyHandler reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\ActivatableClasses\Package\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1630852E-1263-465B-98E5-FE60FFEC4AC2} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.nvr reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F271-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\change-pin reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\68AB67CA7DA700005205CA31A0E45600\SourceList\Net reg.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe 5316 HighHappy.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5316 HighHappy.exe Token: SeDebugPrivilege 5316 HighHappy.exe Token: 33 5700 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5700 AUDIODG.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5316 wrote to memory of 5452 5316 HighHappy.exe 82 PID 5316 wrote to memory of 5544 5316 HighHappy.exe 85 PID 5316 wrote to memory of 5608 5316 HighHappy.exe 86 PID 5544 wrote to memory of 6088 5544 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\HighHappy.exe"C:\Users\Admin\AppData\Local\Temp\HighHappy.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C vssadmin delete shadows /for=C: /all2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5452
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\reg.exereg delete HKCR /f3⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6088
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /s /q "C:\Windows\System32"2⤵
- System Location Discovery: System Language Discovery
PID:5608
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
PID:5700
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
1Pre-OS Boot
1Bootkit
1