Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 09:43
General
- Target f473474711885867b6c6b98c2076f99dd284afffe90b2db861d35c47669e1170.exe
- Size 932KB
- Sample260720-lp7d4sf18t
- SHA256 f473474711885867b6c6b98c2076f99dd284afffe90b2db861d35c47669e1170
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f473474711885867b6c6b98c2076f99dd284afffe90b2db861d35c47669e1170.exe"C:\Users\Admin\AppData\Local\Temp\f473474711885867b6c6b98c2076f99dd284afffe90b2db861d35c47669e1170.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jtcbs.exe"C:\ProgramData\jtcbs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\jtcbs.exeC:\ProgramData\jtcbs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Documents and Settings .exe
Mira.h
jtcbs.exe
$Recycle.Bin .exe
DDF.sys .exe
DumpStack.log.tmp .exe
PerfLogs .exe
Program Files (x86) .exe
Program Files .exe
ProgramData .exe
Recovery .exe
System Volume Information .exe
Users .exe
Users .exe
Windows .exe
Windows.old .exe
pagefile.sys .exe
swapfile.sys .exe
$RECYCLE.BIN .exe
System Volume Information .exe
memory/1860-56-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1860-70-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4112-8-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4800-57-0x0000000000400000-0x0000000000448000-memory.dmp