Analysis
- max time kernel
148s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
05/05/2026, 04:29
General
- Target Class of '09/Launch Class of '09.lnk
- Size 985B
- Sample260505-e4ppaagv3t
- SHA256 d41c201a9b6b12cba96d153c107905f2b1c9b2af3b0a0cd8a2c1e1bcd5b17176
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Class of '09\Launch Class of '09.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Class of '09\Class_Of_09.exe"C:\Users\Admin\AppData\Local\Temp\Class of '09\Class_Of_09.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1540-167-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-166-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-133-0x0000000000700000-0x000000000070C000-memory.dmp
memory/1540-134-0x00007FFE36760000-0x00007FFE3676D000-memory.dmp
memory/1540-131-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-222-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-132-0x00000000025C0000-0x0000000002A32000-memory.dmp
memory/1540-130-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-138-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-137-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-174-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-144-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-152-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-151-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-159-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-158-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-3-0x0000000140000000-0x0000000140021000-memory.dmp
memory/1540-2-0x0000000140008000-0x0000000140009000-memory.dmp
memory/1540-145-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-173-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-181-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-180-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-188-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-187-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-195-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-194-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-202-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-201-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-209-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-208-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-216-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/1540-215-0x00007FFE21370000-0x00007FFE223AA000-memory.dmp
memory/1540-223-0x00007FFE20D50000-0x00007FFE21369000-memory.dmp
memory/5940-128-0x0000024DAD6C0000-0x0000024DADB32000-memory.dmp