Resubmissions
26/07/2026, 23:23
260726-3dd2vssfnd1026/07/2026, 23:22
260726-3cqn9ssxgv426/07/2026, 23:21
260726-3cgrcsen4z326/07/2026, 23:21
260726-3b6n4aen4s3Analysis
- user interaction
yes - max time kernel
256s - max time network
224s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-es - resource tags
- submitted
26/07/2026, 23:23
General
- Target Debug.zip
- Size 16.0MB
- Sample260726-3dd2vssfnd
- SHA256 3bbf9016933beb7a5b1a6bdd4bcdf54de712214940f187c3a223ef2385dfd749
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 2 IoCs
- Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
- Disables use of System Restore points 1 TTPs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 16 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer start page 1 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Debug.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\Debug\Alya-san.exe"C:\Users\Admin\Desktop\Debug\Alya-san.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- UAC bypass
- Blocks application from running via registry modification
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\CurrentControlSet\Services\AVP21.3" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\ControlSet001\Services\AVP21.3" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\CurrentControlSet\Services\MBAMService" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\ControlSet001\Services\MBAMService" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\CurrentControlSet\Services\VSSERV" /f2⤵
-
-
C:\Windows\system32\reg.exedelete "HKLM\SYSTEM\ControlSet001\Services\VSSERV" /f2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 43922⤵
- Program crash
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4336 -ip 43361⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\crashlog.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
road.mp4
Alya-san.ini
Alya-san.ini~RFe5a2348.TMP
crashlog.txt
memory/4336-20-0x000000000AAA0000-0x000000000AB06000-memory.dmp
memory/4336-38-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-9-0x000000000A130000-0x000000000A13E000-memory.dmp
memory/4336-10-0x000000000AC30000-0x000000000AC76000-memory.dmp
memory/4336-7-0x000000000A0D0000-0x000000000A0F0000-memory.dmp
memory/4336-6-0x0000000009FB0000-0x0000000009FB8000-memory.dmp
memory/4336-19-0x000000000AA00000-0x000000000AA0E000-memory.dmp
memory/4336-0-0x0000000074E42000-0x0000000074E43000-memory.dmp
memory/4336-21-0x0000000074E42000-0x0000000074E43000-memory.dmp
memory/4336-36-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-39-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-8-0x000000000A160000-0x000000000A19E000-memory.dmp
memory/4336-37-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-40-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-41-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-43-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-42-0x000000000C520000-0x000000000C530000-memory.dmp
memory/4336-5-0x00000000062D0000-0x0000000006362000-memory.dmp
memory/4336-2-0x0000000007360000-0x000000000791A000-memory.dmp
memory/4336-63-0x00000000143C0000-0x00000000144C2000-memory.dmp
memory/4336-1-0x0000000000670000-0x0000000001780000-memory.dmp