Analysis
- user interaction
yes - max time kernel
140s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 17:11
General
- Target Protected_my project blyat.exe
- Size 9.0MB
- Sample260804-vqevxsea96
- SHA256 8982d1f96784f4ef5c5629bbffdce42748b57f85c8313af488526bc86a9defc7
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 8 IoCs
- Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Protected_my project blyat.exe"C:\Users\Admin\AppData\Local\Temp\Protected_my project blyat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Protected_my project blyat.exe"C:\Users\Admin\AppData\Local\Temp\Protected_my project blyat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp8vqd9a9l.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp8vqd9a9l.exeC:\Users\Admin\AppData\Local\Temp\tmp8vqd9a9l.exe4⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /sc minute /mo 1 /tn "tmp8vqd9a9l" /tr "C:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exeC:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exe1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /sc minute /mo 1 /tn "tmp8vqd9a9l" /tr "C:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exe"C:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exe"1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /sc minute /mo 1 /tn "tmp8vqd9a9l" /tr "C:\Users\Admin\AppData\Roaming\tmp8vqd9a9l.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\CloseGroup.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\CloseGroup.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Excel.CampaignStates.json
Excel.GovernedChannelStates.json
Excel.Settings.json
Excel.SurveyEventActivityStats.json
67453594-7F26-46F8-8357-334D09734435
mip_sdk.miplog
excel.exe.db-wal
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
ucrtbase.dll
tmp8vqd9a9l.exe
~msnDEV-b29842a9e1f9623c.tmp
~msnDEV-b29842a9e1f9623c.tmp
CloseGroup.xlsx.LNK
index.dat
ROLV81W07Y60XUW7Y3R2.temp
b8ab77100df80ab2.customDestinations-ms
memory/3184-106-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-124-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-131-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-208-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-125-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-151-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-133-0x00007FF7ECA10000-0x00007FF7ECA29000-memory.dmp
memory/3700-132-0x000000031AFD0000-0x000000031B02A000-memory.dmp
memory/4876-134-0x00007FFD419A0000-0x00007FFD419B0000-memory.dmp
memory/4876-140-0x00007FFD3F0E0000-0x00007FFD3F0F0000-memory.dmp
memory/4876-139-0x00007FFD3F0E0000-0x00007FFD3F0F0000-memory.dmp
memory/4876-138-0x00007FFD419A0000-0x00007FFD419B0000-memory.dmp
memory/4876-137-0x00007FFD419A0000-0x00007FFD419B0000-memory.dmp
memory/4876-135-0x00007FFD419A0000-0x00007FFD419B0000-memory.dmp
memory/4876-136-0x00007FFD419A0000-0x00007FFD419B0000-memory.dmp
memory/5348-93-0x00007FF7C23F0000-0x00007FF7C2409000-memory.dmp
memory/5348-80-0x000000031AFD0000-0x000000031B02A000-memory.dmp