Analysis
- user interaction
yes - max time kernel
649s - max time network
652s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 09:24
Errors
General
- Target install.exe
- Size 225KB
- Sample260418-ldff9act6m
- SHA256 2e6c8e34a50c71b244469bc61b81b1ffd46ad6ba3e269aa30580574e3882bf57
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\install.exeC:\Users\Admin\AppData\Local\Temp\install.exe --stat dwnldr/p=635487/fail=12⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\NortonFucker.bat1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\NortonFucker.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K copy C:\Windows\System32\*.* C:\Users\Admin\Desktop2⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 200 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\Desktop\shutdown.exeshutdown -r -f -o -t 12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wsl.exeC:\Windows\system32\wsl.exe --list2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa20 --server 0xa1c2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Taskmgr.exe"C:\Windows\system32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39eb855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\bootim.exebootim.exe /startpage:11⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
YandexPackSetup.exe
__PSScriptPolicyTest_wmmripah.sbt.ps1
MicrosoftEdgeDevTools.exe
NortonFucker.bat
dpnet.dll
perfd009.dat
shutdown.exe
sspicli.dll
ReAgent.xml
memory/1660-9019-0x0000023FB1760000-0x0000023FB180F000-memory.dmp
memory/1844-9015-0x000001C9FD770000-0x000001C9FD81F000-memory.dmp
memory/1964-17-0x0000000001810000-0x00000000018EF000-memory.dmp
memory/2596-8999-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-8995-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-9018-0x000001D8AE7A0000-0x000001D8AE84F000-memory.dmp
memory/2596-8996-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-8989-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-8991-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-8990-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-9001-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-9000-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-8997-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2596-8998-0x000001D8B17B0000-0x000001D8B17B1000-memory.dmp
memory/2848-9040-0x00000147181B0000-0x00000147182D0000-memory.dmp
memory/3384-9008-0x000001AD944D0000-0x000001AD945F0000-memory.dmp
memory/3556-5082-0x00000193FC870000-0x00000193FC990000-memory.dmp
memory/4360-9009-0x0000029C797C0000-0x0000029C797CC000-memory.dmp
memory/4360-9011-0x0000029C79E00000-0x0000029C79E12000-memory.dmp
memory/4360-9010-0x0000029C79D00000-0x0000029C79DAF000-memory.dmp
memory/4360-8979-0x0000029C79FF0000-0x0000029C7A012000-memory.dmp
memory/4360-8986-0x0000029C7A410000-0x0000029C7A456000-memory.dmp
memory/4396-19-0x0000000001590000-0x000000000166F000-memory.dmp
memory/4872-9002-0x000002834ECD0000-0x000002834EDF0000-memory.dmp
memory/4960-20-0x000001B0CD930000-0x000001B0CDA50000-memory.dmp
memory/4960-30-0x000001B0CD930000-0x000001B0CDA50000-memory.dmp
memory/4960-22-0x000001B0CD930000-0x000001B0CDA50000-memory.dmp
memory/4960-25-0x000001B0CD930000-0x000001B0CDA50000-memory.dmp
memory/4960-26-0x000001B0CD930000-0x000001B0CDA50000-memory.dmp