Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
27/06/2026, 04:30
General
- Target AfterEffects_2026.exe
- Size 8.4MB
- Sample260627-e41rjsht8p
- SHA256 59e5266f45763d911c9a545242847a5772c104a24efec6587423ba6d908ef2c6
Malware Config
Signatures
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AfterEffects_2026.exe"C:\Users\Admin\AppData\Local\Temp\AfterEffects_2026.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Roaming\WindowsUpdate\wd.bat" /inheritance:r /grant:r %USERNAME%:(RX) /deny %USERNAME%:(DE) >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Roaming\WindowsUpdate\wd.bat" /inheritance:r /grant:r Admin:(RX) /deny Admin:(DE)4⤵
- Modifies file permissions
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Roaming\WindowsUpdate\wd.bat" /inheritance:r /grant:r %USERNAME%:(RX) /deny %USERNAME%:(DE) >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\icacls.exeicacls "C:\Users\Admin\AppData\Roaming\WindowsUpdate\wd.bat" /inheritance:r /grant:r Admin:(RX) /deny Admin:(DE)3⤵
- Modifies file permissions
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsDefender.lnk
My Agent.exe
id
wd.bat
memory/2020-227-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-233-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-36-0x000000029A970000-0x000000029A97D000-memory.dmp
memory/2020-26-0x0000000207610000-0x000000020761D000-memory.dmp
memory/2020-66-0x0000000207E30000-0x0000000207E42000-memory.dmp
memory/2020-56-0x0000000372200000-0x000000037220D000-memory.dmp
memory/2020-245-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-219-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-243-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-241-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-223-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-239-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-225-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-237-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-235-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/2020-77-0x00000003A51D0000-0x00000003A51DD000-memory.dmp
memory/3048-228-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-224-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-234-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-248-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-236-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-226-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-238-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-232-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-240-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-222-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-242-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-220-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-244-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/3048-246-0x00007FF6C6E30000-0x00007FF6C96EA000-memory.dmp
memory/6080-25-0x00007FF71BC10000-0x00007FF71E4CA000-memory.dmp
memory/6080-0-0x00000002A1770000-0x00000002A177E000-memory.dmp