Analysis
- user interaction
yes - max time kernel
45s - max time network
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 21:31
General
- Target SKlauncher-4.0.29-web-setup.exe
- Size 838KB
- Sample260702-1c217ab18m
- SHA256 62b2d500c04740285f9723071aa3dafc762246ba64205c98a10012748861a14b
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 8 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 16 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKlauncher-4.0.29-web-setup.exe"C:\Users\Admin\AppData\Local\Temp\SKlauncher-4.0.29-web-setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\sklauncher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_uxpgjoek.xdf.ps1
INetC.dll
StdUtils.dll
System.dll
UAC.dll
nsDialogs.dll
nsExec.dll
memory/2844-138-0x0000020204120000-0x0000020204140000-memory.dmp
memory/2844-95-0x00000202001E0000-0x00000202002E0000-memory.dmp
memory/2844-101-0x0000020201D40000-0x0000020201D60000-memory.dmp
memory/2844-100-0x0000020201E20000-0x0000020201F20000-memory.dmp
memory/2844-99-0x0000020201A20000-0x0000020201A40000-memory.dmp
memory/4756-84-0x000000006FF60000-0x00000000702BB000-memory.dmp
memory/4756-81-0x000000006FD50000-0x000000006FD9C000-memory.dmp
memory/5224-50-0x00000000077F0000-0x000000000780A000-memory.dmp
memory/5224-40-0x0000000007440000-0x0000000007476000-memory.dmp
memory/5224-41-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/5224-46-0x0000000007740000-0x00000000077E3000-memory.dmp
memory/5224-47-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/5224-48-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/5224-49-0x0000000007E70000-0x00000000084EC000-memory.dmp
memory/5224-42-0x000000006FD50000-0x000000006FD9C000-memory.dmp
memory/5224-51-0x0000000007860000-0x000000000786A000-memory.dmp
memory/5224-53-0x0000000007A30000-0x0000000007A54000-memory.dmp
memory/5224-52-0x0000000007A00000-0x0000000007A2A000-memory.dmp
memory/5224-54-0x000000006FF00000-0x000000007025B000-memory.dmp
memory/5224-56-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/5224-27-0x00000000733A2000-0x00000000733A3000-memory.dmp
memory/5224-28-0x0000000002FA0000-0x0000000002FD6000-memory.dmp
memory/5224-45-0x0000000006A70000-0x0000000006A90000-memory.dmp
memory/5224-29-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/5224-39-0x0000000006560000-0x00000000065AC000-memory.dmp
memory/5224-30-0x0000000005900000-0x0000000005F4A000-memory.dmp
memory/5224-31-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/5224-32-0x00000000055B0000-0x00000000055D2000-memory.dmp
memory/5224-33-0x0000000005650000-0x00000000056B6000-memory.dmp
memory/5224-38-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/5224-37-0x0000000006050000-0x00000000063AB000-memory.dmp
memory/5224-34-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/6136-73-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/6136-71-0x0000000007AE0000-0x0000000007AF1000-memory.dmp
memory/6136-70-0x0000000007B80000-0x0000000007C16000-memory.dmp
memory/6136-67-0x000000006FD50000-0x000000006FD9C000-memory.dmp
memory/6136-65-0x0000000005FF0000-0x000000000634B000-memory.dmp
memory/6136-62-0x0000000073390000-0x0000000073B4C000-memory.dmp
memory/6136-61-0x0000000073390000-0x0000000073B4C000-memory.dmp