Analysis
- user interaction
yes - max time kernel
104s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe
- Size 7.2MB
- Sample260802-d5sa5acp3t
- SHA256 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed
- MD5 a5bcf77071321d74de41fbb9cdaf6a21
- SHA1 4563c5b886d0b0ace968fa4cff7058714a4014e2
- SHA512 a49be5d48117eb8cee05a9321ef73d07726d7938fca6bfe492390276503d4e5ff362486fe7985ec33ea71d4a593c54ea33744091887af6914b8821c9113565f4
- SSDEEP 12288:PO0ZKUhR/fZ0EF9rD36gq2mpKAIbKqPxUBa+HBs557Uyy9fNcm3x9w88C72myVld:PO0Z9hxFF9X36C7VufNcm3x9we/
- TLSH T16A766B0BE59465ECD85EC075832A83E2FB2FF48A071179EB81F453243F55AA81E3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Modifies RDP port number used by Windows 1 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe File opened for modification C:\Windows\System32\GroupPolicy\User\Scripts\Logon\WindowsSync.bat a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe File opened for modification C:\Windows\System32\GroupPolicy\User\Scripts\scripts.ini a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\logs\StorGroupPolicy.log svchost.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe 3548 taskmgr.exe 3548 taskmgr.exe 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3548 taskmgr.exe Token: SeSystemProfilePrivilege 3548 taskmgr.exe Token: SeCreateGlobalPrivilege 3548 taskmgr.exe Token: 33 3548 taskmgr.exe Token: SeIncBasePriorityPrivilege 3548 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe 3548 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3548 taskmgr.exe 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4140 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe 89 PID 4140 wrote to memory of 4740 4140 net.exe 91 PID 3408 wrote to memory of 1948 3408 a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe 92 PID 1948 wrote to memory of 2096 1948 net.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe"C:\Users\Admin\AppData\Local\Temp\a7c98f69bf0c7dbfeef1c0e0f7cbadcfb5387045bf64afd630113ddec27bdeed.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:4740
-
-
-
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:2096
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
- Drops file in Windows directory
PID:5036
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2112
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:244
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 128B
- SHA256 80631bac5e5a8892e71e09750c92924086ca744fdd7be2865cfe6350fed72f9e
- MD5 8e6524f0b69b883d2a08f51cd5309135
- SHA1 94c51406cf97993cf419b84e82d67c4e9bb3574a
- SHA512 046417cf93f6cf187a1ae4a48c96df7157ddab15f729b875aeb1d07e970dc459a170e1af02b432bc0fb53fcc3c49a0d67063c1b2bfc655af344c8bf47427ce04
- TLSH T13CB02B1208C22110C014765281542950C1703E4045604CAFE049B08C337075B8046D0D
- MD5 SHA1 SHA512 TLSH