Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 07:06
General
- Target 427ece970b9d2ae80d3932dcfeff0d631c05c8b09b267f80f554578b3bbee2b4.exe
- Size 4.0MB
- Sample260712-hw7rnsfx6x
- SHA256 427ece970b9d2ae80d3932dcfeff0d631c05c8b09b267f80f554578b3bbee2b4
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Executes dropped EXE 1 IoCs
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file 8 IoCs
Detects executables packed with VMProtect commercial packer.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\427ece970b9d2ae80d3932dcfeff0d631c05c8b09b267f80f554578b3bbee2b4.exe"C:\Users\Admin\AppData\Local\Temp\427ece970b9d2ae80d3932dcfeff0d631c05c8b09b267f80f554578b3bbee2b4.exe"2⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\427ece970b9d2ae80d3932dcfeff0d631c05c8b09b267f80f554578b3bbee2b4.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\ProgramData\Microsoft\iscsicli.exe"C:\ProgramData\Microsoft\iscsicli.exe"2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
iscsicli.exe
memory/2864-63-0x000001978DF10000-0x000001978DF11000-memory.dmp
memory/2864-41-0x00007FFBEE6F0000-0x00007FFBEE700000-memory.dmp
memory/2864-77-0x000001978DEE0000-0x000001978DEE1000-memory.dmp
memory/2864-76-0x000001978DEE0000-0x000001978DEE1000-memory.dmp
memory/2864-75-0x000001978DEE0000-0x000001978DEE1000-memory.dmp
memory/2864-74-0x000001978DEE0000-0x000001978DEE1000-memory.dmp
memory/2864-72-0x000001978FE10000-0x000001978FE11000-memory.dmp
memory/2864-69-0x000001978FE30000-0x000001978FE31000-memory.dmp
memory/2864-68-0x000001978FE20000-0x000001978FE21000-memory.dmp
memory/2864-67-0x000001978FE30000-0x000001978FE31000-memory.dmp
memory/2864-66-0x0000019790A90000-0x0000019790B39000-memory.dmp
memory/2864-65-0x000001978FE20000-0x000001978FE21000-memory.dmp
memory/2864-30-0x000001978DF70000-0x000001978E1EC000-memory.dmp
memory/2864-55-0x000001978DF20000-0x000001978DF21000-memory.dmp
memory/2864-34-0x000001978DF70000-0x000001978E1EC000-memory.dmp
memory/2864-53-0x000001978DEF0000-0x000001978DEF1000-memory.dmp
memory/2864-40-0x000001978DF70000-0x000001978E1EC000-memory.dmp
memory/2864-47-0x00007FFBEE6F0000-0x00007FFBEE700000-memory.dmp
memory/2864-48-0x000001978DEE0000-0x000001978DEE1000-memory.dmp
memory/2864-64-0x000001978DEF0000-0x000001978DEF1000-memory.dmp
memory/2864-62-0x000001978DF20000-0x000001978DF21000-memory.dmp
memory/2864-61-0x0000019790A90000-0x0000019790B39000-memory.dmp
memory/2864-60-0x000001978DF10000-0x000001978DF1F000-memory.dmp
memory/2864-58-0x000001978DEE0000-0x000001978DEE1000-memory.dmp
memory/2864-33-0x000001978DF70000-0x000001978E1EC000-memory.dmp
memory/2864-56-0x000001978DDE0000-0x000001978DDE1000-memory.dmp
memory/2864-54-0x000001978DF70000-0x000001978E1EC000-memory.dmp
memory/2864-57-0x000001978DEF0000-0x000001978DEF1000-memory.dmp
memory/5712-73-0x0000000000180000-0x0000000000288000-memory.dmp
memory/5712-13-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/5712-14-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/5712-16-0x0000000000180000-0x0000000000288000-memory.dmp
memory/5712-0-0x0000000000180000-0x0000000000288000-memory.dmp
memory/5712-1-0x0000000000180000-0x0000000000288000-memory.dmp
memory/5712-32-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/6576-49-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/6576-52-0x00000000047A0000-0x0000000004A46000-memory.dmp
memory/6576-27-0x0000000001320000-0x000000000132D000-memory.dmp
memory/6576-21-0x00000000047A0000-0x0000000004A46000-memory.dmp
memory/6576-18-0x00000000047A0000-0x0000000004A46000-memory.dmp
memory/6576-20-0x00000000047A0000-0x0000000004A46000-memory.dmp
memory/6576-50-0x0000000003680000-0x0000000003681000-memory.dmp
memory/6576-17-0x0000000001310000-0x0000000001313000-memory.dmp
memory/6576-15-0x0000000001310000-0x0000000001313000-memory.dmp
memory/6576-51-0x0000000003AE0000-0x0000000003AE1000-memory.dmp