Analysis
- max time kernel
28s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 10:34
General
- Target DS4Windows.exe
- Size 3.0MB
- Sample260415-ml9whaex91
- SHA256 eb34f8552e8685bd013933ba6f5d8e7bf2b77b1e8ea43bc2287a0532b55c02e9
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DS4Windows.exe"C:\Users\Admin\AppData\Local\Temp\DS4Windows.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
memory/1800-20-0x000001CEBC0E0000-0x000001CEBC18E000-memory.dmp
memory/2120-27-0x000001C88FC00000-0x000001C88FCAE000-memory.dmp
memory/2120-25-0x000001C88FC00000-0x000001C88FCAE000-memory.dmp
memory/2120-26-0x000001C8902F0000-0x000001C890302000-memory.dmp
memory/3912-3-0x000001E71DCA0000-0x000001E71DCB0000-memory.dmp
memory/3912-19-0x000001E71DCA0000-0x000001E71DCB0000-memory.dmp
memory/3912-21-0x000001E705370000-0x000001E70537C000-memory.dmp
memory/3912-23-0x000001E71DCA0000-0x000001E71DCB0000-memory.dmp
memory/3912-24-0x000001E71DCA0000-0x000001E71DCB0000-memory.dmp
memory/3912-22-0x000001E7204A0000-0x000001E720576000-memory.dmp
memory/3912-0-0x000001E703400000-0x000001E70370C000-memory.dmp
memory/3912-4-0x000001E71DCA0000-0x000001E71DCB0000-memory.dmp
memory/3912-1-0x000001E71DCA0000-0x000001E71DCB0000-memory.dmp