Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 23:49
General
- Target d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce.exe
- Size 12.3MB
- Sample260719-3vb9labx2t
- SHA256 d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce.exe"C:\Users\Admin\AppData\Local\Temp\d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create LogMgrv3 binPath= "C:\Users\Admin\AppData\Local\packages\syslog.exe 9ZE+37yC8l6+xov/QPzfifFGpsrP50m0kNi4WezWmPIv0KzvySvOmw==" displayName= "LogMgrv3" start= auto2⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\packages\syslog.exeC:\Users\Admin\AppData\Local\packages\syslog.exe 9ZE+37yC8l6+xov/QPzfifFGpsrP50m0kNi4WezWmPIv0KzvySvOmw==1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
favicon06.png
syslog.exe
memory/1188-53-0x000002E81B970000-0x000002E81B982000-memory.dmp
memory/1188-42-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-4-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-5-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-6-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-7-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-60-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-3-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-54-0x000002E81B900000-0x000002E81B90A000-memory.dmp
memory/1188-0-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp
memory/1188-34-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-1-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-2-0x000002E818F40000-0x000002E819B92000-memory.dmp
memory/1188-48-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-50-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-47-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-46-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-21-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-45-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-44-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-43-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-49-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-41-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-40-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/1188-39-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-11-0x0000026EA0860000-0x0000026EA0882000-memory.dmp
memory/4340-33-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-31-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-30-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-29-0x0000026EA08E0000-0x0000026EA08EA000-memory.dmp
memory/4340-28-0x0000026EA0B20000-0x0000026EA0BD2000-memory.dmp
memory/4340-27-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-26-0x0000026EA0B00000-0x0000026EA0B1E000-memory.dmp
memory/4340-23-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-22-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-20-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-18-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-19-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-17-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-16-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-15-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-14-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-13-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-12-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4340-8-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp