Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/07/2026, 18:28
General
- Target Kaentake.exe
- Size 31KB
- Sample260728-w4emrasene
- SHA256 792e1023e5405454b978c83a0cb9b866add8df759596ed42309be6df93f50848
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaentake.exe"C:\Users\Admin\AppData\Local\Temp\Kaentake.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MapleStory.exe"MapleStory.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\pcaui.exe"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {b7f60cfa-b5e1-49c6-b664-4e41ad8d01ae} -a "Maple story" -v "Wizet" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\MapleStory.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 8723⤵
- Program crash
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3008 -ip 30081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
memory/3008-55-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-37-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-0-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-6-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-5-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-4-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-10-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-9-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-11-0x0000000000400000-0x0000000000E95000-memory.dmp
memory/3008-8-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-7-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-12-0x0000000000E92000-0x0000000000E94000-memory.dmp
memory/3008-13-0x0000000000400000-0x0000000000E95000-memory.dmp
memory/3008-2-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-32-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-65-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-64-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-63-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-62-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-61-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-60-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-59-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-58-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-57-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-1-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-56-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-46-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-53-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-52-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-51-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-50-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-49-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-48-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-66-0x0000000000400000-0x0000000000E95000-memory.dmp
memory/3008-47-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-54-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-45-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-44-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-43-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-42-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-41-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-40-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-39-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-38-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-3-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-36-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-35-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-34-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-33-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-31-0x000000006D790000-0x000000006D7A0000-memory.dmp
memory/3008-30-0x000000006D790000-0x000000006D7A0000-memory.dmp