Analysis
- user interaction
yes - max time kernel
1799s - max time network
1786s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 01:41
General
- Target conhost.exe
- Size 460KB
- Sample260420-b4f6csfs7n
- SHA256 84b30bd016b52f6452cfb324f36febc89461e113698ce57309a8eb5ea9b0ff26
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\conhost.exe"C:\Users\Admin\AppData\Local\Temp\conhost.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ErrorPageTemplate[1]
bullet[2]
httpErrorPagesScripts[1]
background_gradient[1]
errorPageStrings[1]
navcancl[1]
info_48[1]
memory/224-325-0x0000022CF4D10000-0x0000022CF4D1A000-memory.dmp
memory/224-324-0x0000022CDA750000-0x0000022CDA77C000-memory.dmp
memory/224-332-0x0000022CF45F0000-0x0000022CF45F8000-memory.dmp
memory/224-333-0x0000022CF4D70000-0x0000022CF4D7C000-memory.dmp
memory/224-330-0x0000022CF4DB0000-0x0000022CF4DC4000-memory.dmp
memory/224-329-0x0000022CF4DD0000-0x0000022CF4DF2000-memory.dmp
memory/224-328-0x0000022CF6400000-0x0000022CF64A8000-memory.dmp
memory/224-326-0x0000022CF4D40000-0x0000022CF4D48000-memory.dmp
memory/5068-6-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-3-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-2-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-1-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-70-0x00000000012C0000-0x000000000139F000-memory.dmp
memory/5068-4-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-0-0x0000000074551000-0x0000000074552000-memory.dmp
memory/5068-5-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-8-0x0000000007E30000-0x0000000007E36000-memory.dmp
memory/5068-7-0x00000000012C0000-0x000000000139F000-memory.dmp
memory/5068-13-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-10-0x0000000074550000-0x0000000074B01000-memory.dmp
memory/5068-9-0x0000000074550000-0x0000000074B01000-memory.dmp