Analysis
- user interaction
yes - max time kernel
89s - max time network
44s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 11:55
General
- Target cwn0iCkhfwHh.exe
- Size 14.8MB
- Sample260602-n3khlsct6y
- SHA256 6c0a615b74865dd06ef890b206612b7186c55e5641b5509f2c106dfbd58203bf
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cwn0iCkhfwHh.exe"C:\Users\Admin\AppData\Local\Temp\cwn0iCkhfwHh.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\ldrupd.bin"C:\Users\Admin\AppData\Local\ldrupd.bin"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cwn0iCkhfwHh.exe"C:\Users\Admin\AppData\Local\Temp\cwn0iCkhfwHh.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cwn0iCkhfwHh.exe
ldrupd.bin
memory/544-835-0x0000000140000000-0x000000014245C000-memory.dmp
memory/544-834-0x0000000140000000-0x000000014245C000-memory.dmp
memory/544-833-0x0000000140000000-0x000000014245C000-memory.dmp
memory/544-1562-0x0000000140000000-0x000000014245C000-memory.dmp
memory/544-1561-0x0000000140000000-0x000000014245C000-memory.dmp
memory/544-1371-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1373-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1365-0x0000000140000000-0x000000014245C000-memory.dmp
memory/544-1385-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1376-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1374-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1370-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1372-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1368-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-1363-0x0000000004740000-0x00000000056DE000-memory.dmp
memory/544-837-0x00000000005B0000-0x00000000005B1000-memory.dmp
memory/544-836-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-577-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-563-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-621-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-620-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-619-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-618-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-617-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-616-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-615-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-614-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-613-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-612-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-611-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-610-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-609-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-608-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-607-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-606-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-605-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-604-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-603-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-602-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-601-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-600-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-599-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-598-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-597-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-596-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-595-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-594-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-593-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-592-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-590-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-589-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-588-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-587-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-586-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-585-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-584-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-583-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-582-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-581-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-580-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-579-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-578-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-569-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-575-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-574-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-572-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-571-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-570-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-567-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-566-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-565-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-564-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-622-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-562-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-561-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-560-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-559-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-558-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-557-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-556-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-555-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-554-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-553-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-551-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-550-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-549-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-548-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-547-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-591-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-543-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-542-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-541-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-540-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-538-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-537-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-536-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-535-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-534-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-533-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-532-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-531-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-623-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-626-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-632-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-630-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-629-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-633-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-634-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-576-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-539-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-544-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-545-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-546-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-552-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-568-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-573-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-5-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2840-4-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-3-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-2-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-0-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-1-0x0000000140000000-0x000000014245C000-memory.dmp
memory/2840-631-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-635-0x0000000004780000-0x000000000571E000-memory.dmp
memory/2840-636-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2840-824-0x0000000140000000-0x000000014245C000-memory.dmp