Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 11:10
General
- Target Snapshot/Snapshot备份还原.exe
- Size 530KB
- Sample260806-m9pkgazanf
- SHA256 5ef67d9fa3d61e35f6ced2bf996ef8d3b65dc430cb5e4f3bb1f46f86a10b0ac9
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot备份还原.exe"C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot备份还原.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4708-0-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-2-0x00000000004BD000-0x00000000004BE000-memory.dmp
memory/4708-5-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-4-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-14-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-15-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-17-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-20-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-28-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-50-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-54-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-57-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-40-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-37-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-29-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-60-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-59-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-61-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-62-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-63-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-64-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-65-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-66-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-67-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-68-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-69-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-70-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-72-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-71-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-73-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-75-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-77-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-78-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-79-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-80-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-76-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-74-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-81-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-82-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-83-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-84-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-85-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-86-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-87-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-88-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-89-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-90-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-91-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-92-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-93-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-94-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-95-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-96-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-97-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4708-98-0x0000000000400000-0x0000000000594000-memory.dmp