Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 16:51
General
- Target 14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe
- Size 4.3MB
- Sample260424-vdbmqsft5j
- SHA256 14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe"C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe" /force "\\.\pipe\AHKLLHDPJCM"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe"C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe" /autostart1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe" /force "\\.\pipe\AHKBBHDKBGC" "/autostart"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AutoHotkey_Exec.exe
Config.ini
Config.ini
__PSScriptPolicyTest_2gwxit5o.yzo.ps1
config.ini
memory/704-216-0x0000000000870000-0x00000000008A1000-memory.dmp
memory/2236-58-0x00000000013C0000-0x00000000013F1000-memory.dmp
memory/2236-112-0x00000000013C0000-0x00000000013F1000-memory.dmp
memory/2616-0-0x0000000140000000-0x0000000140449000-memory.dmp
memory/2616-1-0x0000000140730000-0x0000000140796000-memory.dmp
memory/2616-6-0x00000000053E0000-0x00000000057E0000-memory.dmp
memory/2616-11-0x0000000140000000-0x0000000140449000-memory.dmp
memory/2616-12-0x0000000000870000-0x00000000008A1000-memory.dmp
memory/2616-2-0x0000000140730000-0x0000000140796000-memory.dmp
memory/3400-109-0x0000000000870000-0x00000000008A1000-memory.dmp
memory/3400-108-0x0000000140000000-0x0000000140449000-memory.dmp
memory/3400-100-0x0000000140730000-0x0000000140796000-memory.dmp
memory/3940-21-0x000001FC74AB0000-0x000001FC74AD2000-memory.dmp
memory/3940-36-0x000001FC74E70000-0x000001FC74E7A000-memory.dmp
memory/3940-35-0x000001FC74E60000-0x000001FC74E66000-memory.dmp
memory/3940-39-0x000001FC72A70000-0x000001FC72AA1000-memory.dmp
memory/3940-41-0x000001FC749A0000-0x000001FC749B2000-memory.dmp
memory/3940-40-0x000001FC746D0000-0x000001FC746DC000-memory.dmp
memory/3940-34-0x000001FC74E30000-0x000001FC74E38000-memory.dmp
memory/3940-33-0x000001FC74FE0000-0x000001FC74FFA000-memory.dmp
memory/3940-32-0x000001FC74E20000-0x000001FC74E2A000-memory.dmp
memory/3940-31-0x000001FC74E40000-0x000001FC74E5C000-memory.dmp
memory/3940-30-0x000001FC74D30000-0x000001FC74D3A000-memory.dmp
memory/3940-28-0x000001FC74D40000-0x000001FC74D5C000-memory.dmp
memory/3940-29-0x000001FC74D60000-0x000001FC74E13000-memory.dmp
memory/3940-13-0x000001FC749D0000-0x000001FC749E0000-memory.dmp
memory/3940-14-0x000001FC749D0000-0x000001FC749E0000-memory.dmp