Analysis
- max time kernel
23s - max time network
162s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 16:49
General
- Target 380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b.exe
- Size 1.1MB
- Sample260707-vbvb3aay5j
- SHA256 380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 13 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b.exe"C:\Users\Admin\AppData\Local\Temp\380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b.exe"C:\Users\Admin\AppData\Local\Temp\380ecbc88b67dc9b7df9fd1858fd24fd83f3e5f82e660b59a3924ff4c5a3035b.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 2283⤵
- Program crash
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4288 -ip 42881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
memory/804-209-0x0000000006F10000-0x0000000006F46000-memory.dmp
memory/804-218-0x0000000007430000-0x00000000074C6000-memory.dmp
memory/804-216-0x00000000071C0000-0x00000000071DA000-memory.dmp
memory/804-215-0x0000000007810000-0x0000000007E8C000-memory.dmp
memory/804-214-0x0000000006F60000-0x0000000007003000-memory.dmp
memory/804-213-0x0000000006340000-0x0000000006360000-memory.dmp
memory/804-210-0x000000006FEF0000-0x000000006FF3C000-memory.dmp
memory/804-196-0x00000000024D0000-0x0000000002506000-memory.dmp
memory/804-217-0x0000000007230000-0x000000000723A000-memory.dmp
memory/804-206-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/804-207-0x0000000005DA0000-0x0000000005DEC000-memory.dmp
memory/804-204-0x00000000058E0000-0x0000000005C3B000-memory.dmp
memory/804-201-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/804-200-0x00000000055D0000-0x0000000005636000-memory.dmp
memory/804-199-0x0000000004EE0000-0x0000000004F02000-memory.dmp
memory/804-198-0x0000000004F80000-0x00000000055CA000-memory.dmp
memory/4288-195-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4448-174-0x000001FC4DA00000-0x000001FC4F2DC000-memory.dmp
memory/4448-32-0x000001FC4BBA0000-0x000001FC4BCA0000-memory.dmp
memory/4448-31-0x000001FC4BBA0000-0x000001FC4BCA0000-memory.dmp
memory/4448-37-0x0000020452790000-0x00000204527B0000-memory.dmp
memory/4448-39-0x0000020452DF0000-0x0000020452EF0000-memory.dmp
memory/4448-77-0x00000204640B0000-0x00000204640D0000-memory.dmp
memory/4448-45-0x0000020452AA0000-0x0000020452AC0000-memory.dmp
memory/4864-197-0x0000000074590000-0x0000000074D4C000-memory.dmp
memory/4864-182-0x0000000007A20000-0x0000000007AFE000-memory.dmp
memory/4864-0-0x00000000745A2000-0x00000000745A3000-memory.dmp
memory/4864-9-0x0000000074590000-0x0000000074D4C000-memory.dmp
memory/4864-8-0x00000000058F0000-0x0000000005910000-memory.dmp
memory/4864-7-0x00000000745A2000-0x00000000745A3000-memory.dmp
memory/4864-6-0x00000000057C0000-0x000000000585C000-memory.dmp
memory/4864-5-0x0000000074590000-0x0000000074D4C000-memory.dmp
memory/4864-4-0x00000000055D0000-0x00000000055DA000-memory.dmp
memory/4864-3-0x0000000005660000-0x00000000056F2000-memory.dmp
memory/4864-2-0x0000000005B80000-0x000000000613A000-memory.dmp
memory/4864-1-0x0000000000990000-0x0000000000AA6000-memory.dmp