Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
03/08/2026, 02:01
General
- Target 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe
- Size 5.6MB
- Sample260803-cf2b3azzc1
- SHA256 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af
Malware Config
Signatures
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe"C:\Users\Admin\AppData\Local\Temp\6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cleanmgr.execleanmgr.exe2⤵
-
-
C:\Windows\SysWOW64\diskperf.exediskperf.exe2⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic baseboard get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
memory/1524-7-0x0000000001A60000-0x0000000001A61000-memory.dmp
memory/1524-1-0x00000000019E0000-0x00000000019E1000-memory.dmp
memory/1524-5-0x0000000001A40000-0x0000000001A41000-memory.dmp
memory/1524-4-0x0000000001A30000-0x0000000001A31000-memory.dmp
memory/1524-3-0x0000000001A20000-0x0000000001A21000-memory.dmp
memory/1524-20-0x0000000000400000-0x00000000012A9000-memory.dmp
memory/1524-6-0x0000000001A50000-0x0000000001A51000-memory.dmp
memory/1524-11-0x0000000000400000-0x00000000012A9000-memory.dmp
memory/1524-12-0x0000000000400000-0x00000000012A9000-memory.dmp
memory/1524-2-0x00000000019F0000-0x00000000019F1000-memory.dmp
memory/1524-0-0x0000000000ACE000-0x0000000000D16000-memory.dmp
memory/1524-18-0x0000000000ACE000-0x0000000000D16000-memory.dmp
memory/2628-38-0x00000000041B0000-0x00000000041E8000-memory.dmp
memory/2628-44-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-19-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-16-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-22-0x000000007637C000-0x000000007637D000-memory.dmp
memory/2628-23-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-24-0x0000000004C60000-0x0000000004CFE000-memory.dmp
memory/2628-26-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-27-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-29-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-34-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-33-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-32-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-31-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-30-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-28-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-21-0x00000000041B0000-0x00000000041E8000-memory.dmp
memory/2628-14-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-40-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-39-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-41-0x000000007637C000-0x000000007637D000-memory.dmp
memory/2628-42-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-43-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-15-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-46-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-45-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-47-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-48-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-49-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-53-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-56-0x0000000076360000-0x0000000076450000-memory.dmp
memory/2628-60-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-62-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-63-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-65-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-66-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-68-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-69-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-13-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-71-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-72-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-74-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-75-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-77-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-78-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-80-0x0000000000400000-0x0000000000A1F000-memory.dmp
memory/2628-81-0x0000000000400000-0x0000000000A1F000-memory.dmp