Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 09:21
General
- Target 登录成功后点击首页不知道为什么会退出.MP4.exe
- Size 3.3MB
- Sample260724-lbtabswtgt
- SHA256 40035c20a806cafa02a373da58b7f2cc13ff9d71d546258c879a487fa28091d4
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\登录成功后点击首页不知道为什么会退出.MP4.exe"C:\Users\Admin\AppData\Local\Temp\登录成功后点击首页不知道为什么会退出.MP4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn Adobe_Update /tr C:\ProgramData\USOShared\FWConst.exe /sc minute /mo 100 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn Adobe_Update2⤵
-
-
C:\ProgramData\USOShared\FWConst.exe"C:\ProgramData\USOShared\FWConst.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\ProgramData\USOShared\FWConst.exeC:\ProgramData\USOShared\FWConst.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
FWConst.dll
FWConst.exe
FWConst.tlb
memory/1128-13-0x00007FFC2CB20000-0x00007FFC2CB60000-memory.dmp
memory/1128-19-0x000002397F790000-0x000002397F7E8000-memory.dmp
memory/1128-20-0x000002397FE70000-0x000002397FE72000-memory.dmp
memory/2776-10-0x000001AE5BE20000-0x000001AE5BE6C000-memory.dmp
memory/2776-11-0x000001AE5BEA0000-0x000001AE5BEF8000-memory.dmp
memory/2776-12-0x000001AE5BF50000-0x000001AE5BF52000-memory.dmp
memory/2776-14-0x000001AE5BE20000-0x000001AE5BE6C000-memory.dmp
memory/4784-9-0x00007FFC2CB20000-0x00007FFC2CB60000-memory.dmp