Resubmissions
22/05/2026, 16:28
260522-ty4nksct2z122/05/2026, 16:28
260522-tyv2facs9y122/05/2026, 16:27
260522-tx4beshy7n1Analysis
- user interaction
yes - max time kernel
35s - max time network
37s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 16:27
Errors
General
- Target Bluescreen.bat
- Size 1KB
- Sample260522-tx4beshy7n
- SHA256 88e555414887a5c50e602b33fd295f47a565ebc8bfa6bd4ec7c7574f5eff0a75
Malware Config
Signatures
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bluescreen.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.exeCSCRIPT //nologo "C:\Users\Admin\AppData\Local\Temp\~tmpSendKeysTemp.vbs"2⤵
-
-
C:\Windows\system32\shutdown.exeshutdown /r2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ProtectConvertTo.wav"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39fe055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
~tmpSendKeysTemp.vbs
memory/3996-6-0x00007FF9EB020000-0x00007FF9EB054000-memory.dmp
memory/3996-11-0x00007FF9E6F30000-0x00007FF9E6F5B000-memory.dmp
memory/3996-24-0x00007FF9EA7C0000-0x00007FF9EA7DA000-memory.dmp
memory/3996-22-0x00007FF9E6590000-0x00007FF9E65B6000-memory.dmp
memory/3996-26-0x00007FF9E6540000-0x00007FF9E6551000-memory.dmp
memory/3996-25-0x00007FF9E7DA0000-0x00007FF9E7DB1000-memory.dmp
memory/3996-32-0x00007FF9DDC50000-0x00007FF9DDE95000-memory.dmp
memory/3996-16-0x00007FF9E6820000-0x00007FF9E6AB6000-memory.dmp
memory/3996-31-0x000001B078F00000-0x000001B0791DB000-memory.dmp
memory/3996-12-0x00007FF9E6BA0000-0x00007FF9E6F30000-memory.dmp
memory/3996-30-0x00007FF9E6210000-0x00007FF9E6235000-memory.dmp
memory/3996-28-0x00007FF9E6290000-0x00007FF9E6328000-memory.dmp
memory/3996-27-0x00007FF9E6330000-0x00007FF9E653B000-memory.dmp
memory/3996-17-0x00007FF9E6730000-0x00007FF9E6818000-memory.dmp
memory/3996-23-0x00007FF9E6560000-0x00007FF9E658D000-memory.dmp
memory/3996-29-0x00007FF9E6240000-0x00007FF9E628F000-memory.dmp
memory/3996-15-0x00007FF9E6AC0000-0x00007FF9E6B92000-memory.dmp
memory/3996-21-0x00007FF9EF630000-0x00007FF9EF648000-memory.dmp
memory/3996-20-0x00007FF9E65C0000-0x00007FF9E65EF000-memory.dmp
memory/3996-18-0x00007FF9E6640000-0x00007FF9E6723000-memory.dmp
memory/3996-19-0x00007FF9E65F0000-0x00007FF9E6631000-memory.dmp
memory/3996-13-0x00007FF9F8520000-0x00007FF9F8534000-memory.dmp
memory/3996-7-0x00007FF9E7950000-0x00007FF9E7C06000-memory.dmp
memory/3996-14-0x00007FF9F10E0000-0x00007FF9F10F1000-memory.dmp
memory/3996-10-0x00007FF9EDA50000-0x00007FF9EDA72000-memory.dmp
memory/3996-8-0x00007FF9F8890000-0x00007FF9F88A1000-memory.dmp
memory/3996-9-0x00007FF9F87D0000-0x00007FF9F87E9000-memory.dmp
memory/3996-5-0x00007FF760BD0000-0x00007FF760CC8000-memory.dmp