Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/07/2026, 13:53
General
- Target 单文件制作工具 7.0.2.3865_x86_x64/单文件制作工具 7.0.2.3865_x86.exe
- Size 4.5MB
- Sample260728-q63jpsywhy
- SHA256 6491c644a730e029db4f4caba581708cbdffec8ecff346669b3255ab193638f9
Malware Config
Signatures
- AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\单文件制作工具 7.0.2.3865_x86_x64\单文件制作工具 7.0.2.3865_x86.exe"C:\Users\Admin\AppData\Local\Temp\单文件制作工具 7.0.2.3865_x86_x64\单文件制作工具 7.0.2.3865_x86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3304-0-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-1-0x000000000107D000-0x000000000107E000-memory.dmp
memory/3304-47-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-101-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-104-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-105-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-106-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-107-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-108-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-109-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-110-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-111-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-112-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-113-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-114-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-115-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-116-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-117-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-118-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-119-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-120-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-121-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-122-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-123-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-124-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-125-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-126-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-127-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-128-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-129-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-130-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-131-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-132-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-133-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-134-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-135-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-136-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-137-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-138-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-139-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-140-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-141-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-142-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-143-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-144-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-145-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-146-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-147-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-148-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-149-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-150-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-151-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-152-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-153-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-154-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-155-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-156-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-157-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-158-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-159-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-160-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-161-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-162-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-163-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-164-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-165-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-166-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-167-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-168-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-169-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-170-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-171-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-172-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-173-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-174-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-175-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-176-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-177-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-178-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-179-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-180-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-181-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-182-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-183-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-184-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-185-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-186-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-187-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-188-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-189-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-190-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-191-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-192-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-193-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-194-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-195-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-196-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-197-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-198-0x000000000107D000-0x000000000107E000-memory.dmp
memory/3304-199-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-200-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-201-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-202-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-203-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-204-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-205-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-206-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-207-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-208-0x0000000000400000-0x0000000001090000-memory.dmp
memory/3304-209-0x0000000000400000-0x0000000001090000-memory.dmp