Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 10:25
General
- Target 744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
- Size 3.2MB
- Sample260421-mf12eafy5v
- SHA256 744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe"C:\Users\Admin\AppData\Local\Temp\744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe"1⤵
- Manipulates Digital Signatures
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x4141⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1992-0-0x00007FF670110000-0x00007FF670B01000-memory.dmp
memory/1992-7-0x000001E7BE310000-0x000001E7BE318000-memory.dmp
memory/1992-6-0x000001E7BDE50000-0x000001E7BE2C2000-memory.dmp
memory/1992-5-0x00007FF670110000-0x00007FF670B01000-memory.dmp