b17be2c8e909eb54f6c8df2749e5e55d098c2ed4197dfdffd4fa65a0b8e7a5f4

Analysis

max time kernel
148s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PotassiumX.sfx.exe
Size 449KB
Sample260710-1ej86aax2n
SHA256 b17be2c8e909eb54f6c8df2749e5e55d098c2ed4197dfdffd4fa65a0b8e7a5f4
MD5 e987cf2788d251e4204ce1391ea3259d
SHA1 fa69e8b0ab9d1655a379e11dddea843daefe6d5d
SHA512 ae440d4f85c7f2bd8d43bec8a2c27f9a6d6a29cd81929ad31d507d24e21ed01d361e5a4ccd3942b07f0e83df1169067c70f1fb9710c29599f6261dfe78d32dc9
SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3l+/XRne:qmiMZvN43+u85Bpw+YMRkc9Bo/XRne
TLSH
T1E7A46C19D7E405F9E0B7E578CD938922EB767C494761E68F03E49DA32F232908D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	PotassiumX.sfx.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3200	mspaint.exe
3200	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3200	mspaint.exe
3200	mspaint.exe
3200	mspaint.exe
3200	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3200	3700	PotassiumX.sfx.exe	87

C:\Users\Admin\AppData\Local\Temp\PotassiumX.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\PotassiumX.sfx.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.png
Size 6KB
SHA256 f56524614314c0a7f070143e6bed33462124dc4be485802d589a6c83b2a1a71b
MD5 e8d86af98ca687f17ecab626fd17081e
SHA1 9410e81c30fe54444aa30ac1cdc6b376e8c3de88
SHA512 c5bd3ae084a3d6d2d1b642783f878c7d55519e5d3cd800ba5916a44b9e963821848ab05c08557a6e95816df7d10e35c9c107754a91601a8d5bfcc892d5d0d226
SSDEEP 96:r428dpIo9H8qX9Ry/YXsvzYLXNrF4ZtSVBcsx82+745pIcgrTtuSdOT7JBt8t000:8lpTR8qkYLXNrF4+cQq4oOT77tzAAt
TLSH
T1C9D18EE71219AC9EEBE6D5B1A1C456114C40161035817D7321C2EFBE0B81DF943C7E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download