Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 02:13
General
- Target 5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe
- Size 408KB
- Sample260529-cnes2aa19s
- SHA256 5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 1 IoCs
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file 8 IoCs
Detects executables packed with VMProtect commercial packer.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 1 IoCs
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 8 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Program Files\wksprt.exe"C:\Program Files\wksprt.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Utilman.exe"C:\Windows\system32\Utilman.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe"C:\Users\Admin\AppData\Local\Temp\5c918be3457b78e57c0622f26ea8999b044d03d7b420157930da15b4158914d0.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wksprt.exe
memory/396-1-0x00000000000A0000-0x00000000001A7000-memory.dmp
memory/396-5-0x00000000000A0000-0x00000000001A7000-memory.dmp
memory/396-11-0x0000000004140000-0x0000000004141000-memory.dmp
memory/396-12-0x0000000004140000-0x0000000004141000-memory.dmp
memory/396-13-0x0000000004140000-0x0000000004141000-memory.dmp
memory/396-14-0x0000000004140000-0x0000000004141000-memory.dmp
memory/396-0-0x00000000000A0000-0x00000000001A7000-memory.dmp
memory/3172-52-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/3172-15-0x00000000010F0000-0x00000000010F3000-memory.dmp
memory/3172-20-0x0000000006E90000-0x0000000007125000-memory.dmp
memory/3172-25-0x00000000010F0000-0x00000000010F3000-memory.dmp
memory/3172-26-0x0000000001120000-0x0000000001121000-memory.dmp
memory/3172-16-0x00000000010F0000-0x00000000010F3000-memory.dmp
memory/3172-55-0x0000000001120000-0x0000000001121000-memory.dmp
memory/3172-54-0x0000000006E90000-0x0000000007125000-memory.dmp
memory/3172-50-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/3172-19-0x0000000006E90000-0x0000000007125000-memory.dmp
memory/3172-51-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/4688-42-0x00007FFF46180000-0x00007FFF46190000-memory.dmp
memory/4688-61-0x00000262772E0000-0x000002627731F000-memory.dmp
memory/4688-49-0x00000262760E0000-0x00000262760E1000-memory.dmp
memory/4688-31-0x00000262759E0000-0x0000026275C47000-memory.dmp
memory/4688-41-0x00000262759E0000-0x0000026275C47000-memory.dmp
memory/4688-43-0x0000026274220000-0x0000026274221000-memory.dmp
memory/4688-35-0x00000262759E0000-0x0000026275C47000-memory.dmp
memory/4688-56-0x0000026276130000-0x0000026276131000-memory.dmp
memory/4688-33-0x00000262759E0000-0x0000026275C47000-memory.dmp
memory/4688-59-0x0000026276140000-0x0000026276141000-memory.dmp
memory/4688-57-0x00000262759E0000-0x0000026275C47000-memory.dmp
memory/4688-58-0x0000026276140000-0x0000026276141000-memory.dmp
memory/4688-60-0x00000262760E0000-0x00000262760E1000-memory.dmp
memory/4688-48-0x00007FFF46180000-0x00007FFF46190000-memory.dmp
memory/4688-64-0x00000262763E0000-0x00000262763E1000-memory.dmp
memory/4688-62-0x00000262774E0000-0x0000026277521000-memory.dmp
memory/4688-65-0x0000026276140000-0x0000026276141000-memory.dmp
memory/4688-63-0x0000026276130000-0x0000026276131000-memory.dmp
memory/4688-67-0x0000026277920000-0x0000026277C26000-memory.dmp
memory/4688-69-0x0000026277920000-0x0000026277C26000-memory.dmp
memory/4688-75-0x00000262772E0000-0x000002627731F000-memory.dmp
memory/4688-76-0x00000262774E0000-0x0000026277521000-memory.dmp
memory/4688-78-0x0000026277FA0000-0x000002627817B000-memory.dmp
memory/4688-79-0x0000026277FA0000-0x000002627817B000-memory.dmp
memory/4688-85-0x0000026277FA0000-0x000002627817B000-memory.dmp