cee7b047466f8c764709bc7beb7a184e6304d810094c4d186635cc2e63d5f97f

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
38s
max time network
34s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 11:12

Target
cracked by dwmxs.exe
Size 2.4MB
Sample261107-nbajbsxt2l
SHA256 cee7b047466f8c764709bc7beb7a184e6304d810094c4d186635cc2e63d5f97f
MD5 3b55d74de76d813565ad7f77dc284dca
SHA1 d3fb16ca439a007c56ef8cf83e6e7f1f4a5e878f
SHA512 228133c56e456a887c5b90f0763f553f60ce522e9f7909d92cbcda4dca59228d328a78c17c5231e6ae24bf0c86ea61c8aebb0f9afc42f84c57295eaf0c37cf66
SSDEEP 24576:rDpdL9ct1j364899MZFuz56i+D4/MS0Wv2g95be7fWSeFUg+2fXwaTA6gJ5BCXD9:XwDj+IxG7iayhXUvX7TAx0O8I9ZUXo
TLSH
T171B5BE4563AE4AACC056A038D5929A07D6F33C440737DFDB13D04D951BAF2D0BAFA6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\85yc7i3v\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\6dmv6cmh\\85yc7i3v.sys"	cracked by dwmxs.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\5lwsdph7\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\6dmv6cmh\\5lwsdph7.sys"	cracked by dwmxs.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3024	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cracked by dwmxs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cracked by dwmxs.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4288	cracked by dwmxs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4288	cracked by dwmxs.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3024	4288	cracked by dwmxs.exe	89

C:\Users\Admin\AppData\Local\Temp\cracked by dwmxs.exe
"C:\Users\Admin\AppData\Local\Temp\cracked by dwmxs.exe"
1⤵
- Sets service image path in registry
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3024