Overview

overview

8

Static

static

3

mituk.exe

windows10-2004-x64

7

mituk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 17:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    mituk.exe
  • Size 11.4MB
  • Sample260628-wd5fgsax21
  • SHA256 21e2eef82fbd5ddb90516c01418a74e6483476d49a99aa333d4928e226f2ca5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 19 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\mituk.exe
    "C:\Users\Admin\AppData\Local\Temp\mituk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Users\Admin\AppData\Local\Temp\mituk.exe
      "C:\Users\Admin\AppData\Local\Temp\mituk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "whoami"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\system32\whoami.exe
          whoami
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2556
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ipconfig"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\system32\ipconfig.exe
          ipconfig
          4⤵
          • Gathers network information
          PID:2236
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "iwconfig"
        3⤵
          PID:5772
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "cat /etc/passwd"
          3⤵
            PID:2380
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "dir"
            3⤵
              PID:2324
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "cat /etc/shadow"
              3⤵
                PID:3608
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1556
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:1888
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3440
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4664

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_bz2.pyd
                • Size 83KB
                • SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_ctypes.pyd
                • Size 129KB
                • SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_hashlib.pyd
                • Size 68KB
                • SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_lzma.pyd
                • Size 156KB
                • SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _queue.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_queue.pyd
                • Size 33KB
                • SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_socket.pyd
                • Size 84KB
                • SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ssl.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_ssl.pyd
                • Size 177KB
                • SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\_wmi.pyd
                • Size 39KB
                • SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\base_library.zip
                • Size 1.3MB
                • SHA256 99c6f5012eb33f4fb8f40c8a0d2c60a5bec800ba1be3cc5f4c282fb5a53e63e5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cacert.pem
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\certifi\cacert.pem
                • Size 274KB
                • SHA256 b1cdd2d665758ef49d08f40ea13e1a826e5f0412e9e0940c921ed1021464cdc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                md.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\charset_normalizer\md.cp313-win_amd64.pyd
                • Size 10KB
                • SHA256 76c8700ffc983bbec07468e354039b21e25e49e7c19f43d7343994c90d4bb7bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                md__mypyc.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
                • Size 122KB
                • SHA256 e9c308245fe01d33ef92c7026115a0a930fd865fbe1bfcefa91e76c6aa32a0b3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libssl-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\libssl-3.dll
                • Size 776KB
                • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python313.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\python313.dll
                • Size 5.8MB
                • SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\select.pyd
                • Size 32KB
                • SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Lorem ipsum.txt
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                • Size 1KB
                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ucrtbase.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\ucrtbase.dll
                • Size 1.1MB
                • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38922\unicodedata.pyd
                • Size 695KB
                • SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/3440-133-0x00000230001E0000-0x00000230002E0000-memory.dmp
                Download

                memory/3440-147-0x0000023003BA0000-0x0000023003BC0000-memory.dmp
                Download

                memory/3440-177-0x0000023014620000-0x0000023014640000-memory.dmp
                Download

                memory/3440-145-0x0000023013DA0000-0x0000023013EA0000-memory.dmp
                Download

                memory/3440-144-0x0000023003930000-0x0000023003950000-memory.dmp
                Download

                memory/4664-290-0x000002D908B00000-0x000002D908F34000-memory.dmp
                Download

                memory/4664-298-0x000002D90B980000-0x000002D90BC3C000-memory.dmp
                Download

                memory/4664-311-0x000002D90B980000-0x000002D90BC3C000-memory.dmp
                Download