Analysis
- max time kernel
299s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 04:08
General
- Target Tax_Notice_84627.exe
- Size 287KB
- Sample260805-eqfjfsdb66
- SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: AddClipboardFormatListener 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notice_84627.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Notice_84627.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RuntimeBroker\RuntimeBroker.exe1⤵
- Adds Run key to start application
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
LexiconBlob.dat
UserLexicon.ini
UserLexicon.ini
UserLexicon.ini
UserLexicon.ini
RuntimeBroker.exe
nvml.dll
memory/2368-32-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-27-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-49-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-58-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-31-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-60-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-20-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-21-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-62-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-65-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-11-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-67-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-59-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-4-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp
memory/2368-109-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-68-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-70-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-66-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-56-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-41-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-42-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-129-0x00007FFD35AD0000-0x00007FFD35AD7000-memory.dmp
memory/2368-85-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-57-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-61-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-17-0x00000000009C0000-0x00000000009F7000-memory.dmp
memory/2368-63-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/2368-64-0x0000000003BB0000-0x0000000003CB3000-memory.dmp
memory/5220-90-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-89-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-81-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-80-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-79-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-77-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-93-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-84-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-87-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-88-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-83-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-36-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-82-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-78-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-46-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-35-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-33-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-26-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-25-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-22-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-19-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-91-0x00000000032E0000-0x00000000033E3000-memory.dmp
memory/5220-18-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-16-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-6-0x0000000002140000-0x00000000021C1000-memory.dmp
memory/5220-7-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-0-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp
memory/5220-110-0x00007FFD35AE0000-0x00007FFD35AE7000-memory.dmp
memory/5220-108-0x00000000007D0000-0x0000000000807000-memory.dmp
memory/5220-1-0x00000000005A0000-0x00000000005A1000-memory.dmp