Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/06/2026, 23:42
General
- Target tmpw0yv2rx7.exe
- Size 225KB
- Sample260608-3p355ahs7q
- SHA256 ccc33ccb0d57f405899be5b62bce00d3210861e29667cd5c5dd39bb80eaa6619
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmpw0yv2rx7.exe"C:\Users\Admin\AppData\Local\Temp\tmpw0yv2rx7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 3004⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 7283⤵
- Program crash
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4600 -ip 46001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3456 -ip 34561⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3256-36-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-53-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-10-0x00000000029D0000-0x00000000029D6000-memory.dmp
memory/3256-14-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-15-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-61-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-60-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-59-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-17-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-18-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-16-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-19-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-20-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-25-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-24-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-22-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-23-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-21-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-26-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-28-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-27-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-29-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-30-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-31-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-32-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-34-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-6-0x0000000000AC0000-0x0000000000AC6000-memory.dmp
memory/3256-35-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-54-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-37-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-38-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-39-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-41-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-40-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-42-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-43-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-44-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-45-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-46-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-47-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-48-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-51-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-50-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-49-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-52-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-33-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-55-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-56-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-5-0x0000000000AC0000-0x0000000000AC6000-memory.dmp
memory/3256-57-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3256-58-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3456-3-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/3456-1-0x00000000049D0000-0x0000000005028000-memory.dmp
memory/3456-2-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/3456-7-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3456-13-0x00000000049D0000-0x0000000005028000-memory.dmp