Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 08:09
General
- Target 56c566348b994a79c0b6fadecb435141830c938469fc607f98c8aae838711f69.exe
- Size 16.7MB
- Sample260706-j2mt5abz2s
- SHA256 56c566348b994a79c0b6fadecb435141830c938469fc607f98c8aae838711f69
Malware Config
Signatures
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56c566348b994a79c0b6fadecb435141830c938469fc607f98c8aae838711f69.exe"C:\Users\Admin\AppData\Local\Temp\56c566348b994a79c0b6fadecb435141830c938469fc607f98c8aae838711f69.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bfvh.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\56c566348b994a79c0b6fadecb435141830c938469fc607f98c8aae838711f69.exe'; $s.Save()"2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1732-24-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-16-0x00007FFC165B0000-0x00007FFC165B1000-memory.dmp
memory/1732-29-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-27-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-25-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-22-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-23-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-19-0x0000023A713A0000-0x0000023A713C2000-memory.dmp
memory/1732-20-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1732-21-0x00007FFC16420000-0x00007FFC16DC4000-memory.dmp
memory/1924-34-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-39-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-30-0x00000000047D0000-0x0000000004B70000-memory.dmp
memory/1924-4-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-5-0x00000000047D0000-0x0000000004B70000-memory.dmp
memory/1924-2-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/1924-33-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-31-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-6-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-0-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/1924-36-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-37-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-1-0x0000000000400000-0x00000000014E3000-memory.dmp
memory/1924-40-0x0000000000400000-0x00000000014E3000-memory.dmp