Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 08:22
General
- Target aa6ee5797773a528b35dcf3e17b21fdd04754a8b9abb21d7d7414d2723cbe5c9.exe
- Size 3.3MB
- Sample260706-j9ll2act2z
- SHA256 aa6ee5797773a528b35dcf3e17b21fdd04754a8b9abb21d7d7414d2723cbe5c9
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa6ee5797773a528b35dcf3e17b21fdd04754a8b9abb21d7d7414d2723cbe5c9.exe"C:\Users\Admin\AppData\Local\Temp\aa6ee5797773a528b35dcf3e17b21fdd04754a8b9abb21d7d7414d2723cbe5c9.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBhADYAZQBlADUANwA5ADcANwA3ADMAYQA1ADIAOABiADMANQBkAGMAZgAzAGUAMQA3AGIAMgAxAGYAZABkADAANAA3ADUANABhADgAYgA5AGEAYgBiADIAMQBkADcAZAA3ADQAMQA0AGQAMgA3ADIAMwBjAGIAZQA1AGMAOQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABhAGEANgBlAGUANQA3ADkANwA3ADcAMwBhADUAMgA4AGIAMwA1AGQAYwBmADMAZQAxADcAYgAyADEAZgBkAGQAMAA0ADcANQA0AGEAOABiADkAYQBiAGIAMgAxAGQANwBkADcANAAxADQAZAAyADcAMgAzAGMAYgBlADUAYwA5AC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB1AHAAZAB0AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHUAcABkAHQALgBlAHgAZQA=2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\updt.exeC:\Users\Admin\AppData\Local\Temp\updt.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
updt.exe
memory/2668-66-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-80-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-3-0x0000000005810000-0x00000000058A2000-memory.dmp
memory/2668-4-0x00000000057E0000-0x00000000057EA000-memory.dmp
memory/2668-5-0x0000000075060000-0x000000007581C000-memory.dmp
memory/2668-6-0x0000000008D60000-0x00000000090BC000-memory.dmp
memory/2668-7-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-14-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-12-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-8-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-18-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-17-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-10-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-35-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-58-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-20-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-56-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-61-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-54-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-52-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-64-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-50-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-48-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-72-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-70-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-0-0x0000000075072000-0x0000000075073000-memory.dmp
memory/2668-88-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-78-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-100-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-106-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-102-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-98-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-94-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-93-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-68-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-46-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-44-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-62-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-42-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-40-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-38-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-36-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-32-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-30-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-28-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-90-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-111-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-108-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-74-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-96-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-86-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-84-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-83-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-76-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-104-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-2-0x0000000005D30000-0x00000000062EA000-memory.dmp
memory/2668-27-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-24-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-22-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-132-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-130-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-128-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-126-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-124-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-122-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-120-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-118-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-116-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-114-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-113-0x0000000008D60000-0x00000000090B6000-memory.dmp
memory/2668-1776-0x0000000075072000-0x0000000075073000-memory.dmp
memory/2668-2071-0x0000000075060000-0x000000007581C000-memory.dmp
memory/2668-6019-0x0000000075060000-0x000000007581C000-memory.dmp
memory/2668-6020-0x0000000009640000-0x0000000009720000-memory.dmp
memory/2668-6021-0x0000000009720000-0x00000000097FE000-memory.dmp
memory/2668-6022-0x0000000007BC0000-0x0000000007C0C000-memory.dmp
memory/2668-6048-0x0000000001730000-0x0000000001784000-memory.dmp
memory/2668-6054-0x0000000075060000-0x000000007581C000-memory.dmp
memory/2668-7517-0x0000000075060000-0x000000007581C000-memory.dmp
memory/2668-1-0x0000000000950000-0x0000000000CB0000-memory.dmp
memory/3264-6044-0x0000000007700000-0x0000000007D7C000-memory.dmp
memory/3264-6043-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6026-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6028-0x0000000004E80000-0x0000000004EA2000-memory.dmp
memory/3264-6027-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6029-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/3264-6030-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/3264-6033-0x0000000005820000-0x0000000005B7B000-memory.dmp
memory/3264-6045-0x00000000070B0000-0x00000000070CA000-memory.dmp
memory/3264-6035-0x0000000005DA0000-0x0000000005DEC000-memory.dmp
memory/3264-6036-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6037-0x0000000006D40000-0x0000000006D76000-memory.dmp
memory/3264-6038-0x0000000070690000-0x00000000706DC000-memory.dmp
memory/3264-6041-0x0000000006340000-0x0000000006360000-memory.dmp
memory/3264-6025-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6042-0x0000000006F80000-0x0000000007023000-memory.dmp
memory/3264-6034-0x0000000005D50000-0x0000000005D6E000-memory.dmp
memory/3264-6024-0x0000000004F30000-0x000000000557A000-memory.dmp
memory/3264-6046-0x0000000007120000-0x000000000712A000-memory.dmp
memory/3264-6047-0x0000000007320000-0x00000000073B6000-memory.dmp
memory/3264-6049-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6050-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6866-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-7413-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-7739-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3264-6023-0x00000000048A0000-0x00000000048D6000-memory.dmp
memory/3264-7957-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4436-6053-0x00000000054E0000-0x00000000055AA000-memory.dmp
memory/4436-6262-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4436-7955-0x0000000005660000-0x00000000056B6000-memory.dmp
memory/4436-6052-0x0000000000400000-0x0000000000492000-memory.dmp
memory/4436-8785-0x0000000075060000-0x000000007581C000-memory.dmp