Analysis
- max time kernel
299s - max time network
256s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
11/05/2026, 01:05
General
- Target Admin.exe
- Size 10.6MB
- Sample260511-bfwadact7p
- SHA256 8b355b4b2a1d88599d06e59300add786067d088bf45eb30358bc3fba735ac7d0
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Admin.exe"C:\Users\Admin\AppData\Local\Temp\Admin.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4852-0-0x00000198C5590000-0x00000198C55B0000-memory.dmp
memory/4852-1-0x00000198C6ED0000-0x00000198C6ED4000-memory.dmp
memory/4852-2-0x00000198C6ED0000-0x00000198C6ED4000-memory.dmp
memory/4852-4-0x00000198C5510000-0x00000198C557B000-memory.dmp
memory/4852-3-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-5-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-7-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-9-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-11-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-13-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-17-0x00000198C6F50000-0x00000198C6F54000-memory.dmp
memory/4852-15-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-18-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-20-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-22-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-24-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-26-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-28-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-30-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-32-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-34-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-36-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-38-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-40-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-42-0x00000198C7FE0000-0x00000198C8000000-memory.dmp
memory/4852-43-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-45-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-47-0x00000198C8210000-0x00000198C8230000-memory.dmp
memory/4852-48-0x00000198C8230000-0x00000198C8250000-memory.dmp
memory/4852-49-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-51-0x00000198C8210000-0x00000198C8230000-memory.dmp
memory/4852-52-0x00000198C8230000-0x00000198C8250000-memory.dmp
memory/4852-53-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-55-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-57-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-59-0x00000198C8210000-0x00000198C8230000-memory.dmp
memory/4852-60-0x00000198C8230000-0x00000198C8250000-memory.dmp
memory/4852-63-0x00000198C8210000-0x00000198C8230000-memory.dmp
memory/4852-61-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-64-0x00000198C8230000-0x00000198C8250000-memory.dmp
memory/4852-65-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-67-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-69-0x00000198C8210000-0x00000198C8230000-memory.dmp
memory/4852-70-0x00000198C8230000-0x00000198C8250000-memory.dmp
memory/4852-71-0x00007FF77F190000-0x00007FF77FD06000-memory.dmp
memory/4852-73-0x00000198C8210000-0x00000198C8230000-memory.dmp
memory/4852-74-0x00000198C8230000-0x00000198C8250000-memory.dmp