Analysis
- user interaction
yes - max time kernel
14s - max time network
117s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
09/08/2026, 00:39
General
- Target VeryFun.exe
- Size 3.0MB
- Sample260809-azz71axdkc
- SHA256 8b04fda4bee1806587657da6c6147d3e949aa7d11be1eefb8cd6ef0dba76d387
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- AutoIT Executable 21 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 4 IoCs
- UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of SendNotifyMessage 19 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VeryFun.exe"C:\Users\Admin\AppData\Local\Temp\VeryFun.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Checks whether UAC is enabled
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x4fc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
AppCache134307096694641281.txt
memory/2600-76-0x00000000038C0000-0x00000000038C1000-memory.dmp
memory/3000-41-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-1-0x0000000001A50000-0x0000000001A5B000-memory.dmp
memory/3000-71-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-73-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-69-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-26-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-0-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-70-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-34-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3000-20-0x0000000000C30000-0x000000000126D000-memory.dmp
memory/3264-33-0x0000000000540000-0x000000000064C000-memory.dmp
memory/3264-32-0x0000000000540000-0x000000000064C000-memory.dmp
memory/3264-31-0x0000000000540000-0x000000000064C000-memory.dmp
memory/3384-29-0x0000000001000000-0x000000000110C000-memory.dmp
memory/3384-30-0x0000000001000000-0x000000000110C000-memory.dmp
memory/3384-28-0x0000000001000000-0x000000000110C000-memory.dmp
memory/3456-19-0x0000000010000000-0x0000000010013000-memory.dmp
memory/3456-17-0x0000000010000000-0x0000000010013000-memory.dmp
memory/3456-2-0x0000000000BF0000-0x0000000000D8C000-memory.dmp
memory/3456-24-0x0000000000BF0000-0x0000000000D8C000-memory.dmp
memory/3456-4-0x0000000000BF0000-0x0000000000D8C000-memory.dmp
memory/3456-5-0x0000000000BF0000-0x0000000000D8C000-memory.dmp
memory/3456-6-0x0000000000BF0000-0x0000000000D8C000-memory.dmp
memory/3456-14-0x0000000010000000-0x0000000010013000-memory.dmp
memory/3456-16-0x0000000010000000-0x0000000010013000-memory.dmp
memory/3456-203-0x0000000000BF0000-0x0000000000D8C000-memory.dmp
memory/3456-27-0x0000000010000000-0x0000000010013000-memory.dmp
memory/3456-18-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/3648-10-0x0000000000530000-0x0000000000624000-memory.dmp
memory/3648-7-0x0000000000530000-0x0000000000624000-memory.dmp
memory/3648-25-0x0000000000530000-0x0000000000624000-memory.dmp
memory/3648-9-0x0000000000530000-0x0000000000624000-memory.dmp
memory/3648-11-0x0000000000530000-0x0000000000624000-memory.dmp
memory/3648-201-0x0000000000530000-0x0000000000624000-memory.dmp
memory/4488-21-0x0000000000810000-0x000000000091C000-memory.dmp
memory/4488-22-0x0000000000810000-0x000000000091C000-memory.dmp
memory/4488-23-0x0000000000810000-0x000000000091C000-memory.dmp
memory/4528-77-0x0000021134560000-0x0000021134660000-memory.dmp
memory/4528-93-0x0000021135920000-0x0000021135940000-memory.dmp
memory/4528-123-0x0000021148920000-0x0000021148A20000-memory.dmp
memory/4528-108-0x0000021135960000-0x0000021135980000-memory.dmp
memory/4528-109-0x0000021135940000-0x0000021135960000-memory.dmp
memory/5648-49-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-43-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-50-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-51-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-52-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-53-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-54-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-48-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-42-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/5648-44-0x0000022C620F0000-0x0000022C620F1000-memory.dmp
memory/6016-36-0x0000000001300000-0x000000000140C000-memory.dmp
memory/6016-37-0x0000000001300000-0x000000000140C000-memory.dmp
memory/6016-35-0x0000000001300000-0x000000000140C000-memory.dmp
memory/6096-39-0x0000000000770000-0x000000000087C000-memory.dmp
memory/6096-40-0x0000000000770000-0x000000000087C000-memory.dmp
memory/6096-38-0x0000000000770000-0x000000000087C000-memory.dmp