Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
28/07/2026, 18:28
General
- Target Kaentake.exe
- Size 31KB
- Sample260728-w4emrasene
- SHA256 792e1023e5405454b978c83a0cb9b866add8df759596ed42309be6df93f50848
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaentake.exe"C:\Users\Admin\AppData\Local\Temp\Kaentake.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MapleStory.exe"MapleStory.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\pcaui.exe"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {b7f60cfa-b5e1-49c6-b664-4e41ad8d01ae} -a "Maple story" -v "Wizet" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\MapleStory.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 8083⤵
- Program crash
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1172 -ip 11721⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
memory/256-70-0x0000024624AE0000-0x0000024625160000-memory.dmp
memory/1172-57-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-40-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-9-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-3-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-5-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-4-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-10-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-8-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-7-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-6-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-1-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-13-0x0000000000400000-0x0000000000E95000-memory.dmp
memory/1172-12-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
memory/1172-2-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-60-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-67-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-66-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-65-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-68-0x0000000000400000-0x0000000000E95000-memory.dmp
memory/1172-64-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-63-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-53-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-61-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-59-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-0-0x0000000000400000-0x0000000000E95000-memory.dmp
memory/1172-56-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-11-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-55-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-62-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-52-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-51-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-50-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-48-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-47-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-46-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-45-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-44-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-43-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-42-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-41-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-39-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-38-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-36-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-34-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-33-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-58-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-49-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-54-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-37-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-35-0x000000006E580000-0x000000006E590000-memory.dmp
memory/1172-32-0x000000006E580000-0x000000006E590000-memory.dmp
memory/3596-30-0x000001DADCC80000-0x000001DADD300000-memory.dmp
memory/3596-29-0x000001DADCC80000-0x000001DADD300000-memory.dmp