Overview

overview

7

Static

static

5

build.exe

windows10-2004-x64

7

build.exe

windows11-ltsc_2024-x64

7

Resubmissions

04/08/2026, 06:50

260804-hl942stcmf

04/08/2026, 06:22

260804-g4ynashk8w7

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 06:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    build.exe
  • Size 9.2MB
  • Sample260804-g4ynashk8w
  • SHA256 d0b04b2d73292574409a54e576ff76a3c2194b1126bdbe9c8acd9825d978f2cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate_6ud8" /tr "\"C:\Users\Admin\AppData\Local\Temp\build.exe\"" /sc ONLOGON /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4692
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" a "-pOnline-fix.me" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\Grand Theft Timeline.7z" "C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\*"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1640
  • C:\Users\Admin\AppData\Local\Temp\build.exe
    C:\Users\Admin\AppData\Local\Temp\build.exe
    1⤵
      PID:4196
    • C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      1⤵
        PID:2492

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Query Registry

            2
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Grand Theft Timeline.7z
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\Grand Theft Timeline.7z
            • Size 4.8MB
            • SHA256 4428a82c4c648f5e13d061b38850c4ce28891e85186381221f8e355e7b78e59c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            History.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Browser\Edge\History.txt
            • Size 66B
            • SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Bookmarks.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Browser\Firefox\Bookmarks.txt
            • Size 367B
            • SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            history.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Credentials\Edge\history.txt
            • Size 70B
            • SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Desktop.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Directories\Desktop.txt
            • Size 926B
            • SHA256 f4e3b99c004d3c73a5f9c809b903d5d7b3db5b354ab4255241c57bca2fa16f12
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Documents.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Directories\Documents.txt
            • Size 1KB
            • SHA256 de0e4f247fd91fe56e8f501fa5d8ced303a6a46d612d391788257bef54ee9a8f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Downloads.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Directories\Downloads.txt
            • Size 1KB
            • SHA256 8b3a0cfffe193025e114200b6b4c9207043ace3afebe9c28b11c9cd4b3c79bf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Music.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Directories\Music.txt
            • Size 430B
            • SHA256 d103870cc0e561d9aff460c9586d485da5ccb633b95a879365a385b0b11d0e64
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Pictures.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Directories\Pictures.txt
            • Size 596B
            • SHA256 f896dc9509307f580152c6d94fec527dc1811d7a1c663a138b3f8742fd107ed4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Videos.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\Directories\Videos.txt
            • Size 64B
            • SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Antivirus.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\System\Antivirus.txt
            • Size 31B
            • SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
            • MD5 SHA1 SHA512
            Submit Download

            MAC Addresses.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\System\MAC Addresses.txt
            • Size 34B
            • SHA256 b615bf4c292b7cccf25d622156350521dfa4a07e55d7e1cc39b8688319030d98
            • MD5 SHA1 SHA512
            Submit Download

            System Info.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\System\System Info.txt
            • Size 724B
            • SHA256 578e41dd45ee8d60d99db6dd4cf95040dc0f5ca8cd5939db55dc7711fc378cd4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Task List.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__792of9gb\organized\System\Task List.txt
            • Size 2KB
            • SHA256 dfadb9d2c970f54fdf8199d07ef4e7db9100b235cb5b7decf622c4af085025d7
            • MD5 SHA1 SHA512 TLSH
            Submit Download