Analysis
- user interaction
yes - max time kernel
422s - max time network
393s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
26/06/2026, 21:34
General
- Target VisonFree (1).exe
- Size 2.6MB
- Sample260626-1e2hfaez21
- SHA256 e4c22e8ce3a75156c88c748a76972d2a117a47fd52df144408edf9b74933c856
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VisonFree (1).exe"C:\Users\Admin\AppData\Local\Temp\VisonFree (1).exe"1⤵
- Enumerates system info in registry
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SearchHoverUnifiedTileModelCache.dat
~earchHoverUnifiedTileModelCache.tmp
memory/1548-0-0x00000233163F0000-0x0000023316696000-memory.dmp
memory/1548-1-0x0000023330C80000-0x0000023330EC4000-memory.dmp
memory/1548-2-0x0000023316AF0000-0x0000023316B00000-memory.dmp
memory/1548-3-0x0000023331D30000-0x0000023331F4C000-memory.dmp
memory/1548-4-0x0000023316AF0000-0x0000023316B00000-memory.dmp
memory/1548-5-0x0000023316AF0000-0x0000023316B00000-memory.dmp
memory/1548-6-0x0000023316AF0000-0x0000023316B00000-memory.dmp
memory/1548-7-0x0000023316AF0000-0x0000023316B00000-memory.dmp
memory/1548-8-0x0000023316AF0000-0x0000023316B00000-memory.dmp