Analysis
- max time kernel
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 11:16
General
- Target fk12.exe
- Size 8.1MB
- Sample260705-ndfs5afx4m
- SHA256 614d235c49f256333d468b7bf2471d481b730387b0d9366a8ad3378eda7384c5
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Possible privilege escalation attempt 3 IoCs
- Loads dropped DLL 7 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Delays execution with timeout.exe 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fk12.exe"C:\Users\Admin\AppData\Local\Temp\fk12.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fk12.exe"C:\Users\Admin\AppData\Local\Temp\fk12.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fk12_launch.cmd"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 20 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32 /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\timeout.exetimeout /t 2 /nobreak1⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\timeout.exetimeout /t 5 /nobreak1⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\timeout.exetimeout /t 20 /nobreak1⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\takeown.exetakeown /f C:\Windows\System32 /r /d y1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\icacls.exeicacls C:\Windows\System32 /grant administrators:F /t1⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
fk12_launch.cmd
fk12_trigger.bat
memory/2240-73-0x00007FFD0E330000-0x00007FFD0E38F000-memory.dmp
memory/2240-70-0x00007FFD0EC50000-0x00007FFD0ECF3000-memory.dmp
memory/2240-51-0x00007FFD11370000-0x00007FFD11437000-memory.dmp
memory/2240-50-0x00007FFD11840000-0x00007FFD11AA3000-memory.dmp
memory/2240-54-0x00007FFD05C50000-0x00007FFD05C61000-memory.dmp
memory/2240-55-0x00007FFD11290000-0x00007FFD11339000-memory.dmp
memory/2240-62-0x00007FFD0EF90000-0x00007FFD0F106000-memory.dmp
memory/2240-63-0x00007FFCF37A0000-0x00007FFCF37D0000-memory.dmp
memory/2240-64-0x00007FFD0E4A0000-0x00007FFD0E4C6000-memory.dmp
memory/2240-67-0x00007FFD0F610000-0x00007FFD0F637000-memory.dmp
memory/2240-68-0x00007FFD11340000-0x00007FFD1136A000-memory.dmp
memory/2240-49-0x00007FF76B990000-0x00007FF76B9FF000-memory.dmp
memory/2240-57-0x00007FFD11730000-0x00007FFD117D7000-memory.dmp
memory/2240-59-0x00007FFD05C30000-0x00007FFD05C46000-memory.dmp
memory/2240-60-0x00007FFD10340000-0x00007FFD10413000-memory.dmp
memory/2240-58-0x00007FFD0FB40000-0x00007FFD0FC56000-memory.dmp
memory/2240-56-0x00007FFD0FC70000-0x00007FFD0FD22000-memory.dmp
memory/2240-52-0x00007FFD0F260000-0x00007FFD0F601000-memory.dmp
memory/2240-53-0x00007FFD0F110000-0x00007FFD0F25B000-memory.dmp
memory/2240-61-0x00007FFD0FFC0000-0x00007FFD1033C000-memory.dmp
memory/2240-65-0x00007FFD0EDC0000-0x00007FFD0EE59000-memory.dmp
memory/2240-66-0x00007FFD0F7D0000-0x00007FFD0F993000-memory.dmp
memory/2240-72-0x00007FFD0BD00000-0x00007FFD0BDAD000-memory.dmp
memory/2240-69-0x00007FFD0EE60000-0x00007FFD0EF81000-memory.dmp
memory/2240-71-0x00007FFD11610000-0x00007FFD1163F000-memory.dmp
memory/4992-37-0x00007FFD11840000-0x00007FFD11AA3000-memory.dmp
memory/4992-36-0x00007FF6E77A0000-0x00007FF6E77B6000-memory.dmp
memory/4992-39-0x00007FFD0F260000-0x00007FFD0F601000-memory.dmp
memory/4992-42-0x00007FFD11730000-0x00007FFD117D7000-memory.dmp
memory/4992-43-0x00007FFD0FB40000-0x00007FFD0FC56000-memory.dmp
memory/4992-46-0x00007FFD0F110000-0x00007FFD0F25B000-memory.dmp
memory/4992-44-0x00007FFD0DD50000-0x00007FFD0DD98000-memory.dmp
memory/4992-45-0x00007FFD0DBD0000-0x00007FFD0DC05000-memory.dmp
memory/4992-41-0x00007FFD0FC70000-0x00007FFD0FD22000-memory.dmp
memory/4992-40-0x00007FFD11290000-0x00007FFD11339000-memory.dmp
memory/4992-38-0x00007FFD11370000-0x00007FFD11437000-memory.dmp