634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Size 1.2MB
Sample261104-3ftkbses2s
SHA256 634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca
MD5 64e6b16a09ac0cae6f0d64f48c42f0c6
SHA1 8f3abfb95440abecdea97eed1dc13d7df0956444
SHA512 935045ac809597a16d99750e64b8146122f1722f85a5814bcd9188296f59ba35d394603670a731770113e3271749e5a2551ab3e52b7e14633f2ece6802152ec4
SSDEEP 24576:Q8MfuECgNL2EEBDO8GCDljvqph++11RQakVZQ:EmwNL5EBDOYD9b+11SaK
TLSH
T1AE458D96F29901FDE0B79078C9965617E7B2B81703209BDB43E48B663F13BE45B39312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a_ghost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe"	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a_ghost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe"	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe

Enumerates video capture drivers 2 TTPs 2 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
Token: SeDebugPrivilege	1764	634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe

C:\Users\Admin\AppData\Local\Temp\634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
"C:\Users\Admin\AppData\Local\Temp\634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe"
1⤵
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Users\Admin\AppData\Local\Temp\634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
C:\Users\Admin\AppData\Local\Temp\634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca.exe
1⤵
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1764