Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 06:12
General
- Target diff-pdf.exe
- Size 2.5MB
- Sample260804-gx7ydsec44
- SHA256 c116ac85297b2972c1831f397a53e2d10d4d51c29420974408d175784fd1403e
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\diff-pdf.exe"C:\Users\Admin\AppData\Local\Temp\diff-pdf.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4952-0-0x00007FFCC5660000-0x00007FFCC5923000-memory.dmp
memory/4952-2-0x00007FFCD8460000-0x00007FFCD84BC000-memory.dmp
memory/4952-1-0x00007FF6AE2D0000-0x00007FF6AE50F000-memory.dmp
memory/4952-8-0x00007FFCCBB80000-0x00007FFCCBD01000-memory.dmp
memory/4952-9-0x00007FFCC5660000-0x00007FFCC5923000-memory.dmp
memory/4952-29-0x00007FFCCE640000-0x00007FFCCE66B000-memory.dmp
memory/4952-34-0x00007FFCC4400000-0x00007FFCC4539000-memory.dmp
memory/4952-36-0x00007FFCC35B0000-0x00007FFCC3B43000-memory.dmp
memory/4952-33-0x00007FFCC4540000-0x00007FFCC45B2000-memory.dmp
memory/4952-32-0x00007FFCC6C40000-0x00007FFCC6C97000-memory.dmp
memory/4952-31-0x00007FFCC45C0000-0x00007FFCC46A9000-memory.dmp
memory/4952-30-0x00007FFCCC180000-0x00007FFCCC219000-memory.dmp
memory/4952-28-0x00007FFCC46B0000-0x00007FFCC47CE000-memory.dmp
memory/4952-27-0x00007FFCC4880000-0x00007FFCC49F4000-memory.dmp
memory/4952-24-0x00007FFCC4A00000-0x00007FFCC4D68000-memory.dmp
memory/4952-20-0x00007FFCC4D70000-0x00007FFCC565D000-memory.dmp
memory/4952-18-0x00007FFCC6DC0000-0x00007FFCC6E76000-memory.dmp
memory/4952-17-0x00007FFCC6890000-0x00007FFCC6A5A000-memory.dmp
memory/4952-25-0x00007FFCD7AE0000-0x00007FFCD7AEE000-memory.dmp
memory/4952-26-0x00007FFCC47D0000-0x00007FFCC4876000-memory.dmp
memory/4952-23-0x00007FFCD08B0000-0x00007FFCD08C6000-memory.dmp
memory/4952-22-0x00007FFCD0CA0000-0x00007FFCD0CBA000-memory.dmp
memory/4952-19-0x00007FFCCE870000-0x00007FFCCE8A6000-memory.dmp
memory/4952-16-0x00007FFCD07A0000-0x00007FFCD07F2000-memory.dmp
memory/4952-13-0x00007FFCC8A50000-0x00007FFCC8B18000-memory.dmp
memory/4952-12-0x00007FFCC8B20000-0x00007FFCC8BDA000-memory.dmp
memory/4952-35-0x00007FFCC3D80000-0x00007FFCC3DD2000-memory.dmp
memory/4952-21-0x00007FFCCE670000-0x00007FFCCE6A7000-memory.dmp
memory/4952-14-0x00007FFCD7AF0000-0x00007FFCD7B05000-memory.dmp
memory/4952-11-0x00007FFCD0CC0000-0x00007FFCD0D06000-memory.dmp
memory/4952-10-0x00007FFCD0D10000-0x00007FFCD0D6B000-memory.dmp
memory/4952-4-0x00007FFCD83E0000-0x00007FFCD845B000-memory.dmp
memory/4952-7-0x00007FFCD9090000-0x00007FFCD90A0000-memory.dmp
memory/4952-6-0x00007FFCD83B0000-0x00007FFCD83DB000-memory.dmp
memory/4952-5-0x00007FFCC5930000-0x00007FFCC5B8D000-memory.dmp
memory/4952-15-0x00007FFCD0800000-0x00007FFCD0825000-memory.dmp
memory/4952-3-0x00007FFCCC490000-0x00007FFCCC5C3000-memory.dmp