Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 18:31
General
- Target 目录(下载到电脑打开)w11.exe
- Size 3.8MB
- Sample260727-w6bc4scf52
- SHA256 245fe76b0a102442e0b9df50d668d6125edcf775f06163d39684c2f413415cfd
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\目录(下载到电脑打开)w11.exe"C:\Users\Admin\AppData\Local\Temp\目录(下载到电脑打开)w11.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1740-0-0x00000000745D2000-0x00000000745D3000-memory.dmp
memory/1740-1-0x0000000000200000-0x0000000000B62000-memory.dmp
memory/1740-2-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/1740-3-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/1740-4-0x00000000054F0000-0x0000000005502000-memory.dmp
memory/1740-5-0x0000000005520000-0x0000000005534000-memory.dmp
memory/1740-6-0x0000000005530000-0x0000000005538000-memory.dmp
memory/1740-7-0x0000000005550000-0x0000000005558000-memory.dmp
memory/1740-8-0x00000000056B0000-0x00000000057FE000-memory.dmp
memory/1740-10-0x0000000005950000-0x0000000005982000-memory.dmp
memory/1740-9-0x0000000005800000-0x0000000005950000-memory.dmp
memory/1740-11-0x0000000005980000-0x00000000059B2000-memory.dmp
memory/1740-12-0x00000000059B0000-0x00000000059BC000-memory.dmp
memory/1740-14-0x00000000059D0000-0x00000000059DA000-memory.dmp
memory/1740-17-0x0000000005A00000-0x0000000005A0A000-memory.dmp
memory/1740-16-0x00000000059F0000-0x00000000059F8000-memory.dmp
memory/1740-15-0x00000000059E0000-0x00000000059EC000-memory.dmp
memory/1740-18-0x0000000005A10000-0x0000000005AC2000-memory.dmp
memory/1740-19-0x0000000005AC0000-0x0000000005B72000-memory.dmp
memory/1740-13-0x00000000059C0000-0x00000000059CE000-memory.dmp
memory/1740-23-0x0000000005BC0000-0x0000000005BCA000-memory.dmp
memory/1740-22-0x0000000005BA0000-0x0000000005BA8000-memory.dmp
memory/1740-21-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/1740-20-0x0000000005B80000-0x0000000005B92000-memory.dmp
memory/1740-24-0x0000000005C30000-0x0000000005C76000-memory.dmp
memory/1740-25-0x00000000066F0000-0x000000000670A000-memory.dmp
memory/1740-26-0x0000000006710000-0x000000000671A000-memory.dmp
memory/1740-27-0x0000000006720000-0x0000000006728000-memory.dmp
memory/1740-28-0x0000000006730000-0x0000000006738000-memory.dmp
memory/1740-29-0x00000000067B0000-0x0000000006816000-memory.dmp
memory/1740-31-0x0000000006780000-0x0000000006788000-memory.dmp
memory/1740-30-0x0000000006760000-0x0000000006768000-memory.dmp
memory/1740-32-0x0000000006790000-0x0000000006798000-memory.dmp
memory/1740-33-0x00000000067A0000-0x00000000067A8000-memory.dmp
memory/1740-34-0x0000000006820000-0x0000000006828000-memory.dmp
memory/1740-35-0x0000000006840000-0x0000000006848000-memory.dmp
memory/1740-36-0x00000000069B0000-0x00000000069B8000-memory.dmp
memory/1740-37-0x0000000007490000-0x0000000007498000-memory.dmp
memory/1740-38-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/1740-39-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/1740-40-0x000000000C5A0000-0x000000000C5DE000-memory.dmp
memory/1740-41-0x0000000007580000-0x000000000758E000-memory.dmp
memory/1740-43-0x000000000AA50000-0x000000000B00A000-memory.dmp
memory/1740-42-0x000000000A3F0000-0x000000000A482000-memory.dmp
memory/1740-44-0x000000000A3D0000-0x000000000A3D8000-memory.dmp
memory/1740-45-0x00000000745D2000-0x00000000745D3000-memory.dmp
memory/1740-46-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/1740-47-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/1740-48-0x00000000745C0000-0x0000000074D7C000-memory.dmp