Analysis
- user interaction
yes - max time kernel
118s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 01:20
General
- Target 55c28ae706e71466105213f097ade42c5022792c67dcfc29e354a1ade36fd4fe.zip
- Size 1.8MB
- Sample260718-bqbcysfv5v
- SHA256 2d7b2edb20c9f7494df48f1952f9bee15e13f5feb3c6c35ba41a9d02c8e1ed7e
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\55c28ae706e71466105213f097ade42c5022792c67dcfc29e354a1ade36fd4fe.zip1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\GroupDismount.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\LockEdit.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3020-1-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-2-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-3-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-4-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-5-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-6-0x00007FFBBC030000-0x00007FFBBC040000-memory.dmp
memory/3020-7-0x00007FFBBC030000-0x00007FFBBC040000-memory.dmp
memory/3020-20-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-22-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-21-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp
memory/3020-19-0x00007FFBBE320000-0x00007FFBBE330000-memory.dmp