Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 18:12
General
- Target da6e1ea8e301c6a64110c72f8e406251160ce1fec379038abb0a57d79a2064a3.exe
- Size 306KB
- Sample260731-wtak2sdn4x
- SHA256 da6e1ea8e301c6a64110c72f8e406251160ce1fec379038abb0a57d79a2064a3
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da6e1ea8e301c6a64110c72f8e406251160ce1fec379038abb0a57d79a2064a3.exe"C:\Users\Admin\AppData\Local\Temp\da6e1ea8e301c6a64110c72f8e406251160ce1fec379038abb0a57d79a2064a3.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML.bak
memory/3632-16-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-19-0x000000001EA50000-0x000000001EA5E000-memory.dmp
memory/3632-3-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-4-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-5-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-6-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-7-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-1-0x0000000000B70000-0x0000000000BC4000-memory.dmp
memory/3632-15-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-0-0x00007FFA7978F000-0x00007FFA79790000-memory.dmp
memory/3632-2-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-18-0x000000001EA90000-0x000000001EACE000-memory.dmp
memory/3632-17-0x000000001E490000-0x000000001E498000-memory.dmp
memory/3632-20-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-21-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-22-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-23-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-24-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-25-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-26-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/3632-27-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp