Analysis
- max time kernel
579s - max time network
581s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 00:46
Errors
General
- Target Cracker.bat
- Size 3.0MB
- Sample260730-a4wqdaap4s
- SHA256 b900a68ffc08824d7857263242ca35d031fbf6d995390591104eac562e75960c
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 38 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 57 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 44 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cracker.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -exec bypass -F "C:\Temp\update.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DriverMonitor /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c shutDown /s /t 05⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shutdown.exeshutDown /s /t 06⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c shutDown /s /t 03⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shutdown.exeshutDown /s /t 04⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39e5055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
Tmp222F.tmp
Ennnn
vijewyufveonabghulluonouceyasi.exe
wwmaw
memory/2460-302-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-376-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-290-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-292-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-296-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-288-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-294-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-298-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-284-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-300-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-304-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-306-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-308-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-310-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-312-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-314-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-316-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-321-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-38-0x0000000007380000-0x0000000007398000-memory.dmp
memory/2460-39-0x0000000007560000-0x00000000075AC000-memory.dmp
memory/2460-325-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-328-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-330-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-332-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-334-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-375-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-337-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-338-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-340-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-349-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-342-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-268-0x0000000002520000-0x00000000025F0000-memory.dmp
memory/2460-270-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-269-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-282-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-280-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-278-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-276-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-274-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-272-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-286-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-322-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-319-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-344-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-326-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-347-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-362-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-372-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-370-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-368-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-366-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-365-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-380-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-378-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-350-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-360-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-358-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-356-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-354-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/2460-352-0x0000000002520000-0x00000000025E9000-memory.dmp
memory/3208-86-0x000001D9001E0000-0x000001D9002E0000-memory.dmp
memory/3208-117-0x000001D903B60000-0x000001D903B80000-memory.dmp
memory/3208-99-0x000001D903900000-0x000001D903920000-memory.dmp
memory/3208-131-0x000001D9152A0000-0x000001D9152C0000-memory.dmp
memory/3208-100-0x000001D903D60000-0x000001D903E60000-memory.dmp
memory/4480-249-0x0000025E3BA90000-0x0000025E3BEC4000-memory.dmp
memory/4668-34-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-7-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-5-0x000001AB58450000-0x000001AB58472000-memory.dmp
memory/4668-11-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-12-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-13-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-6-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-14-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-15-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-10-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-33-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-2-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp
memory/4668-8-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-9-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-19-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-17-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-18-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4668-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4956-35-0x0000000001290000-0x00000000012E8000-memory.dmp
memory/4956-37-0x00000000076C0000-0x0000000007714000-memory.dmp
memory/4956-60-0x0000000008EF0000-0x0000000008F56000-memory.dmp
memory/4956-61-0x0000000009420000-0x00000000094B2000-memory.dmp
memory/4956-62-0x0000000009A80000-0x000000000A03A000-memory.dmp