Analysis
- user interaction
yes - max time kernel
44s - max time network
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 00:06
General
- Target ToolsDownloader++.exe
- Size 17.3MB
- Sample260806-ad9vbaef86
- SHA256 7d6e42a390910baea993d5b264bd162e5b04c78a16eb8ec670817e6471b569fb
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ToolsDownloader++.exe"C:\Users\Admin\AppData\Local\Temp\ToolsDownloader++.exe"1⤵
- Downloads MZ/PE file
- Modifies registry class
-
C:\Users\Admin\Desktop\Detect-Tools-Downloads\Autoruns++.exe"C:\Users\Admin\Desktop\Detect-Tools-Downloads\Autoruns++.exe"2⤵
-
-
C:\Users\Admin\Desktop\Detect-Tools-Downloads\USBDeview++.exe"C:\Users\Admin\Desktop\Detect-Tools-Downloads\USBDeview++.exe"2⤵
-
-
C:\Users\Admin\Desktop\Detect-Tools-Downloads\StringExplorer++.exe"C:\Users\Admin\Desktop\Detect-Tools-Downloads\StringExplorer++.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Autoruns++.exe
StringExplorer++.exe
StringExplorer++.exe
StringExplorer++.exe
USBDeview++.exe
memory/948-39-0x0000000140000000-0x00000001410E4000-memory.dmp
memory/948-38-0x0000000140000000-0x00000001410E4000-memory.dmp
memory/1716-1-0x0000000140000000-0x0000000141159000-memory.dmp
memory/1716-0-0x0000000140000000-0x0000000141159000-memory.dmp
memory/3500-10-0x0000000140000000-0x0000000141324000-memory.dmp
memory/3500-11-0x0000000140000000-0x0000000141324000-memory.dmp
memory/3500-12-0x0000000140000000-0x0000000141324000-memory.dmp
memory/4972-22-0x0000000140000000-0x00000001410F0000-memory.dmp
memory/4972-23-0x0000000140000000-0x00000001410F0000-memory.dmp
memory/4972-49-0x0000000140000000-0x00000001410F0000-memory.dmp