Analysis
- max time kernel
151s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 22:38
General
- Target tws-latest-windows-x64.exe
- Size 96.5MB
- Sample260808-2kljvaff72
- SHA256 52f6445106517fde41599e7c1f5230895b865747563520d1c30a5c01ef5aaa99
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 24 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tws-latest-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\tws-latest-windows-x64.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\INSTAL~1\t\E4J822~1.TMP\jre\bin\java.exe"c:\users\admin\appdata\local\INSTAL~1\t\E4J822~1.TMP\jre\bin\java.exe" -version2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
flatlaf-windows-x86_64.dll
awt.dll
fontmanager.dll
freetype.dll
java.exe
jawt.dll
management.dll
management_ext.dll
net.dll
nio.dll
prefs.dll
zip.dll
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
CLASSPATH_EXCEPTION_NOTE
LICENSE
VCRUNTIME140.dll
java.dll
jimage.dll
jli.dll
msvcp140.dll
jvm.dll
vcruntime140_1.dll
jvm.cfg
memory/2380-607-0x00000177E1770000-0x00000177E19E0000-memory.dmp
memory/2380-745-0x00000177D9CC0000-0x00000177D9F30000-memory.dmp
memory/2380-596-0x00000177E11F0000-0x00000177E1460000-memory.dmp
memory/2380-749-0x00000177D9F50000-0x00000177D9F60000-memory.dmp
memory/2380-747-0x00000177D9F30000-0x00000177D9F40000-memory.dmp
memory/2380-667-0x00000177D9F50000-0x00000177D9F60000-memory.dmp
memory/2380-666-0x00000177D9F40000-0x00000177D9F50000-memory.dmp
memory/2380-665-0x00000177D9F30000-0x00000177D9F40000-memory.dmp
memory/2380-748-0x00000177D9F40000-0x00000177D9F50000-memory.dmp
memory/2380-746-0x00000177E1770000-0x00000177E19E0000-memory.dmp
memory/2380-606-0x00000177D9CC0000-0x00000177D9F30000-memory.dmp
memory/2380-744-0x00000177E11F0000-0x00000177E1460000-memory.dmp
memory/2600-569-0x0000015613030000-0x00000156132A0000-memory.dmp
memory/2600-578-0x00000156135B0000-0x0000015613820000-memory.dmp
memory/2600-579-0x000001560BB00000-0x000001560BD70000-memory.dmp
memory/2600-583-0x00000156135B0000-0x0000015613820000-memory.dmp
memory/2600-584-0x000001560BB00000-0x000001560BD70000-memory.dmp
memory/2600-582-0x0000015613030000-0x00000156132A0000-memory.dmp