Analysis
- user interaction
yes - max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
15/07/2026, 22:04
General
- Target Cleaner.exe
- Size 9.4MB
- Sample260715-1yzsysas7y
- SHA256 e31b34d30de4a3f1e67cfc9dd63be859ebecc2f437a8e5ace9e01f9802984bc2
Malware Config
Signatures
- Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
- Detects KillMBR 2 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
- Executes dropped EXE 7 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 8 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ice Free Temp.exe"C:\Users\Admin\AppData\Local\Temp\Ice Free Temp.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\ice free temp.exe"c:\users\admin\appdata\local\temp\ice free temp.exe "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe4⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe6⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Never.mp3"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
Ice Free Temp.exe
Never.mp3
ice free temp.exe
explorer.exe
icsys.icn.exe
spoolsv.exe
svchost.exe
memory/1224-277-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1736-307-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3000-67-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3564-90-0x00007FFBA6C90000-0x00007FFBA6CA8000-memory.dmp
memory/3564-94-0x00007FFBA2C00000-0x00007FFBA2C11000-memory.dmp
memory/3564-368-0x00007FFB937B0000-0x00007FFB93A66000-memory.dmp
memory/3564-280-0x00007FFB937B0000-0x00007FFB93A66000-memory.dmp
memory/3564-20-0x00007FFB93A5D000-0x00007FFB93A5F000-memory.dmp
memory/3564-73-0x00007FFB937B0000-0x00007FFB93A66000-memory.dmp
memory/3564-75-0x00007FFBA3170000-0x00007FFBA31A4000-memory.dmp
memory/3564-74-0x00007FF7D08F0000-0x00007FF7D09E8000-memory.dmp
memory/3564-80-0x00007FFBA3A80000-0x00007FFBA3AAB000-memory.dmp
memory/3564-79-0x00007FFBA6DF0000-0x00007FFBA6E12000-memory.dmp
memory/3564-78-0x00007FFBAD780000-0x00007FFBAD799000-memory.dmp
memory/3564-84-0x00007FFBA3330000-0x00007FFBA3402000-memory.dmp
memory/3564-86-0x00007FFBA3240000-0x00007FFBA3328000-memory.dmp
memory/3564-87-0x00007FFBA2CA0000-0x00007FFBA2D83000-memory.dmp
memory/3564-95-0x00007FFBA2BE0000-0x00007FFBA2BF1000-memory.dmp
memory/3564-99-0x00007FFB9B1A0000-0x00007FFB9B1C5000-memory.dmp
memory/3564-98-0x00007FFBA2AF0000-0x00007FFBA2B3F000-memory.dmp
memory/3564-97-0x00007FFBA2B40000-0x00007FFBA2BD8000-memory.dmp
memory/3564-96-0x00007FFB93AA0000-0x00007FFB93CAB000-memory.dmp
memory/3564-192-0x00007FFB937B0000-0x00007FFB93A66000-memory.dmp
memory/3564-93-0x00007FFBA2C80000-0x00007FFBA2C9A000-memory.dmp
memory/3564-92-0x00007FFBA3060000-0x00007FFBA308D000-memory.dmp
memory/3564-101-0x000002992E2A0000-0x000002992E5A0000-memory.dmp
memory/3564-100-0x000002992CA30000-0x000002992E29F000-memory.dmp
memory/3564-102-0x00007FFB8D0B0000-0x00007FFB8D2F5000-memory.dmp
memory/3564-91-0x00007FFBA3100000-0x00007FFBA3126000-memory.dmp
memory/3564-22-0x00007FFB937B0000-0x00007FFB93A66000-memory.dmp
memory/3564-89-0x00007FFBA31C0000-0x00007FFBA31EF000-memory.dmp
memory/3564-88-0x00007FFBA31F0000-0x00007FFBA3231000-memory.dmp
memory/3564-76-0x00007FFB937B0000-0x00007FFB93A66000-memory.dmp
memory/3564-85-0x00007FFB92F50000-0x00007FFB931E6000-memory.dmp
memory/3564-83-0x00007FFBA6DD0000-0x00007FFBA6DE1000-memory.dmp
memory/3564-82-0x00007FFBAD690000-0x00007FFBAD6A4000-memory.dmp
memory/3564-81-0x00007FFB931F0000-0x00007FFB93580000-memory.dmp
memory/3564-77-0x00007FFBA6E20000-0x00007FFBA6E31000-memory.dmp
memory/3660-64-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4924-49-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4924-65-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4956-66-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4956-15-0x0000000000400000-0x000000000041F000-memory.dmp