Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 07:10
General
- Target 5dc96244951a3c0ee1bbd7728473c266dd95de5904a349a1a99b19591e98b555.exe
- Size 7.5MB
- Sample260729-hzfglabl5v
- SHA256 5dc96244951a3c0ee1bbd7728473c266dd95de5904a349a1a99b19591e98b555
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dc96244951a3c0ee1bbd7728473c266dd95de5904a349a1a99b19591e98b555.exe"C:\Users\Admin\AppData\Local\Temp\5dc96244951a3c0ee1bbd7728473c266dd95de5904a349a1a99b19591e98b555.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
E2EECore.3.3.9.dll
memory/4888-0-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-1-0x0000000000DCB000-0x0000000000DCC000-memory.dmp
memory/4888-7-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-11-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-12-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-10-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-9-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-39-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-37-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-53-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-51-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-49-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-54-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-47-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-45-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-43-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-35-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-55-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-56-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-33-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-31-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-29-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-27-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-25-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-23-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-21-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-19-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-41-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-57-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-58-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-59-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-60-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-61-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-62-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-63-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-64-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-65-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-69-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-70-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-71-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-72-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-73-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-75-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-76-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-77-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-78-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-79-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-80-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-81-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-82-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-83-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-84-0x0000000000400000-0x0000000000DCC000-memory.dmp
memory/4888-85-0x0000000000400000-0x0000000000DCC000-memory.dmp