Analysis
- user interaction
yes - max time kernel
299s - max time network
207s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 04:58
General
- Target Launcher.cmd
- Size 25B
- Sample260422-fl4adsds4x
- SHA256 05ae6b542fd187c062eac38abfbfb6a9b8f35bbec3aff29950912f7d89092c5a
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\util.exeutil.exe lj_asm.txt2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4880-53-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-63-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-62-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-61-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-60-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-59-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-58-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-57-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-56-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-55-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-54-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-51-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-52-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-49-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-50-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-48-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-47-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-46-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-45-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-44-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-43-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-42-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-41-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-40-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-39-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-38-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-71-0x0000000001430000-0x0000000001431000-memory.dmp
memory/4880-72-0x0000000001430000-0x0000000001431000-memory.dmp
memory/4880-37-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-36-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-35-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-34-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-33-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-32-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-31-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-29-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-26-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-25-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-24-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-23-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-22-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-21-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-20-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-19-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-18-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-17-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-16-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-15-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-13-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-14-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-12-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-11-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-10-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-9-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-8-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-7-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-6-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-5-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-4-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-3-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-2-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-1-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-30-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-28-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-27-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-0-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4880-78-0x0000000001430000-0x0000000001431000-memory.dmp
memory/4880-81-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/4880-80-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/4880-79-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/4880-120-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/4880-118-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/4880-119-0x00000000018D0000-0x00000000018D1000-memory.dmp