Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 14:30
Behavioral task
behavioral1
Sample
2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe
- Size 1.8MB
- Sample260504-rt99fsdx4s
- SHA256 88aee2c9ba53552becd2d54adbe3ccd1ec6f3efb930979a824b290f56ffe9f04
- MD5 2cde008de54705f5819e583599d92195
- SHA1 8efba3bfe6bc3bc182602930fa41a721e0ba90e7
- SHA512 267385563f14c14e537846c1cffc1579fbf83ad441995beb843c5bbb66dc000e383c01a11d3dd00af95dc2272b9a7aa91716d3f32415a913e81db7ea7ff25949
- SSDEEP 24576:K6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqM:KCqm2Jpr0nNM7Dus7NxF
- TLSH T16F951802BCEA14FBC67CF27445966B213672346587336B831E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000200000002a19b-5.dat UPX behavioral2/memory/444-13920-0x0000000000400000-0x00000000005C8000-memory.dmp UPX - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\desktop.ini 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe -
resource yara_rule behavioral2/memory/444-0-0x0000000000400000-0x00000000005C8000-memory.dmp upx behavioral2/files/0x000200000002a19b-5.dat upx behavioral2/memory/444-1808-0x0000000000400000-0x00000000005C8000-memory.dmp upx behavioral2/memory/444-13920-0x0000000000400000-0x00000000005C8000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashScreen.scale-100_altform-colorful.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-400.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-200_contrast-black.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\Snooze.scale-64.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-24_altform-unplated.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-336.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Spring_Right_Dark.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\JitV.dll 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated_contrast-white.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-150.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\GroupedList\GroupedList.styles.js 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-125.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca.pak.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-40_altform-unplated.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsBadgeLogo.scale-100.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\7-Zip\Lang\hr.txt.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-20_altform-lightunplated_contrast-white.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-256_altform-unplated_contrast-black.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-100_contrast-white.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-16_altform-unplated.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-200_contrast-white.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\MessageBar.js.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\Example3B.Diagnostics.Tests.ps1.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\PSGet.Resource.psd1 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-30_contrast-black.png.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-400_contrast-black.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-125.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll.exe 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\MicrosoftLogo.scale-200.png 2026-05-04_2cde008de54705f5819e583599d92195_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 753235a10d8c7bf8d5561dfc1008bb8f0795b194a2e306db8789991da6c409d0
- MD5 69d2d35d4599f72b2ebcfc6d629bf1a4
- SHA1 28bdcffbeb01edca39f369657caed544363b595c
- SHA512 df85c99875185149db1416d0b55f3e16ba0f7357c9c2982255a3aad8a639f708f15ab6d129c96916181b75f2f548a5b96b4094918390575d3b8fd20d743e8d94
- SSDEEP 24576:K6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqN:KCqm2Jpr0nNM7Dus7Nxo
- TLSH T1C6951802BCEA14FBC67CF27445966B213672346587336B831E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH