Analysis
- user interaction
yes - max time kernel
899s - max time network
886s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 10:01
General
- Target seafile-applet.exe
- Size 6.4MB
- Sample260429-l2d84aev3k
- SHA256 75a3dea324bc49142f2780124ae6862af76de19e847c2e81894718e43fa08715
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 11 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\seafile-applet.exe"C:\Users\Admin\AppData\Local\Temp\seafile-applet.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\Desktop\."1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exewt.exe -d "C:\Users\Admin\Desktop\."2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wsl.exeC:\Windows\system32\wsl.exe --list3⤵
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa10 --server 0xa0c3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\seafile-applet.exeC:\Users\Admin\AppData\Local\Temp\seafile-applet.exe1⤵
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
uip.bin
__PSScriptPolicyTest_l05agnj0.cwr.ps1
memory/1760-31-0x000001ACC9220000-0x000001ACC9232000-memory.dmp
memory/1760-30-0x000001ACC7720000-0x000001ACC772C000-memory.dmp
memory/1760-25-0x000001ACC9430000-0x000001ACC9476000-memory.dmp
memory/1760-24-0x000001ACC9340000-0x000001ACC9362000-memory.dmp
memory/4232-4-0x0000022508FF0000-0x000002250976B000-memory.dmp
memory/4232-9-0x000002250C4A0000-0x000002250CBFF000-memory.dmp
memory/4232-0-0x00007FFB0D760000-0x00007FFB0DD21000-memory.dmp
memory/4232-3-0x00007FF643D90000-0x00007FF644402000-memory.dmp
memory/4232-2-0x00007FFB04B30000-0x00007FFB05B30000-memory.dmp
memory/4232-1-0x00007FFB04630000-0x00007FFB04B23000-memory.dmp
memory/4868-32-0x00007FF643D90000-0x00007FF644402000-memory.dmp
memory/4868-34-0x00007FFB04630000-0x00007FFB04B23000-memory.dmp
memory/4868-33-0x00007FFB0D760000-0x00007FFB0DD21000-memory.dmp
memory/4868-36-0x00007FFB1C6A0000-0x00007FFB1C6C0000-memory.dmp
memory/4868-43-0x000002717B890000-0x000002717C00B000-memory.dmp
memory/4868-48-0x00000271006F0000-0x0000027101409000-memory.dmp