Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 03:32
General
- Target 009433e9bac780c6cdd611fb32fa570b34aa2843b1a1595218ee2a1479343eca.exe
- Size 92.2MB
- Sample260701-d3mmvsfv4s
- SHA256 009433e9bac780c6cdd611fb32fa570b34aa2843b1a1595218ee2a1479343eca
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\009433e9bac780c6cdd611fb32fa570b34aa2843b1a1595218ee2a1479343eca.exe"C:\Users\Admin\AppData\Local\Temp\009433e9bac780c6cdd611fb32fa570b34aa2843b1a1595218ee2a1479343eca.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WD_D3B6.tmp\INSTALL.EXE"C:\Users\Admin\AppData\Local\Temp\WD_D3B6.tmp\INSTALL.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WD_D731.tmp\WDSetup.EXE"C:\Users\Admin\AppData\Local\Temp\WD_D731.tmp\WDSetup.EXE" /REP="C:\Users\Admin\AppData\Local\Temp\WD_D3B6.tmp\" /VERSION_PARENT=27 /COMPOSITE=03⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
INSTALL.EXE
INSTALL.ZIP
INST.WXF
WDSetup.EXE
wd270com.dll
wd270hf.dll
wd270mdl.dll
wd270obj.dll
wd270pnt.dll
wd270std.dll
wd270vm.dll
wd270zip.dll
memory/3280-86-0x0000000003E90000-0x0000000003F90000-memory.dmp
memory/3280-191-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-82-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-83-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-75-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-85-0x0000000003E90000-0x0000000003F90000-memory.dmp
memory/3280-84-0x0000000003E90000-0x0000000003F90000-memory.dmp
memory/3280-76-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-77-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-81-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-192-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-195-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-194-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-193-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-196-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-197-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-198-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3280-199-0x0000000003E90000-0x0000000003F90000-memory.dmp
memory/3280-200-0x0000000003E90000-0x0000000003F90000-memory.dmp
memory/3280-201-0x0000000003E90000-0x0000000003F90000-memory.dmp