Analysis
- user interaction
yes - max time kernel
28s - max time network
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 14:58
General
- Target MSS Keygen.exe
- Size 64.1MB
- Sample260702-scea5agw21
- SHA256 663b3a05d54b89c4c0ad502d4ef9cd351adc4cb42cee4ed2baee9221f6cd4a0c
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Windows directory 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MSS Keygen.exe"C:\Users\Admin\AppData\Local\Temp\MSS Keygen.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="MSS Keygen.exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1664.3300.17984130609041559601 /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a2382⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView /prefetch:4 /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a238 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffebec85fd8,0x7ffebec85fe4,0x7ffebec85ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView" --webview-exe-name="MSS Keygen.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,8909551301552587577,7245544513369781814,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a2383⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView" --webview-exe-name="MSS Keygen.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1792,i,8909551301552587577,7245544513369781814,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a2383⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView" --webview-exe-name="MSS Keygen.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1792,i,8909551301552587577,7245544513369781814,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a2383⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView" --webview-exe-name="MSS Keygen.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1792,i,8909551301552587577,7245544513369781814,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a238 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MssKeygen.WebView2\EBWebView" --webview-exe-name="MSS Keygen.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4516 --field-trial-handle=1792,i,8909551301552587577,7245544513369781814,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:c8e02d4a0cd2c8de3fcdb4433e2b7e4c7af7a238 /prefetch:13⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
WebView2Loader.dll
settings.dat
settings.dat
throttle_store.dat
79304a64-8a39-4141-9e9d-f077dec6f99e.tmp
the-real-index
the-real-index~RFe59d845.TMP
MANIFEST-000001
SCT Auditing Pending Reports
Preferences
CURRENT
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe598718.TMP
app.js
cosmic.png
icon.png
matcha.png
matrix.png
potassium.png
synapse.png
volt.png
index.html
styles.css
memory/1316-676-0x000001BE19950000-0x000001BE19A50000-memory.dmp
memory/1316-364-0x000001BE01DF0000-0x000001BE01E10000-memory.dmp
memory/1316-362-0x000001BE01A10000-0x000001BE01A30000-memory.dmp
memory/1316-363-0x000001BE01E60000-0x000001BE01F60000-memory.dmp
memory/1316-378-0x000001BE14320000-0x000001BE14340000-memory.dmp
memory/1316-332-0x000001BE001E0000-0x000001BE002E0000-memory.dmp
memory/1664-23-0x000002551D040000-0x000002551D060000-memory.dmp
memory/1664-19-0x0000025520310000-0x00000255205F0000-memory.dmp
memory/1664-11-0x0000025500000000-0x0000025500CF0000-memory.dmp
memory/1664-79-0x0000025502B30000-0x0000025502B40000-memory.dmp
memory/1664-31-0x000002551D210000-0x000002551D230000-memory.dmp
memory/1664-78-0x0000025502E40000-0x0000025502F00000-memory.dmp
memory/1664-35-0x000002551D230000-0x000002551D250000-memory.dmp
memory/1664-7-0x000002551E4F0000-0x000002551F180000-memory.dmp
memory/1664-57-0x0000025502BA0000-0x0000025502BD0000-memory.dmp
memory/1664-41-0x000002551D6E0000-0x000002551D710000-memory.dmp
memory/1664-45-0x000002551D780000-0x000002551D7C0000-memory.dmp
memory/1664-89-0x0000025503B10000-0x0000025503B50000-memory.dmp
memory/1664-61-0x0000025502B50000-0x0000025502B70000-memory.dmp
memory/1664-83-0x0000025502D30000-0x0000025502D50000-memory.dmp
memory/1664-53-0x000002551D720000-0x000002551D730000-memory.dmp
memory/1664-27-0x000002551D0B0000-0x000002551D0D0000-memory.dmp
memory/1664-15-0x000002551CEF0000-0x000002551CF10000-memory.dmp
memory/1664-49-0x000002551F460000-0x000002551F5E0000-memory.dmp
memory/3488-152-0x00007FFEE13F0000-0x00007FFEE13F1000-memory.dmp
memory/3804-195-0x00007FFEE13F0000-0x00007FFEE13F1000-memory.dmp
memory/3804-300-0x000002088D060000-0x000002088D0D4000-memory.dmp
memory/4468-540-0x000001A1A0C30000-0x000001A1A0CA4000-memory.dmp