Analysis
- user interaction
yes - max time kernel
12s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DisksMacro.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DisksMacro.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target DisksMacro.exe
- Size 154.3MB
- Sample260812-2q4mlsfc25
- SHA256 4933c0709161037ff6e5c5dde5e33e8840e941c990d94e8e7d0e1358a00b4e7e
- MD5 26e8054b9145a708af38cfa8531e96c3
- SHA1 a371fac25b65cc1be4c674d3be5b7f895a8dac56
- SHA512 0e637e48927a985f20a62b71d26f6ad1922c92d629e0ae8769d6e6cf400138927ca3984b3ba4cfc0215a6c89e90b6eb3383fcdb01638cc981d19ff2988acc301
- SSDEEP 786432:R2KeA8Oa89TsG5YWV5OtsFGtatWbhsCrTG5mfOm5cuA0zm767EP/:MPA838JsHWEd2CvG8fOkZboP/
- TLSH T107787D1163E81A45E67B8678D77382A1E6B1BC535711C1CF0094FA4A2F73BC2BA36376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 4868 DisksMacro.exe 4868 DisksMacro.exe 4868 DisksMacro.exe 4868 DisksMacro.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4868 DisksMacro.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\DisksMacro\FXHP3lsuQaVvk+L1R35MB3Ytt9iB2jA=\D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\DisksMacro\FXHP3lsuQaVvk+L1R35MB3Ytt9iB2jA=\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 67629b6aaee39328d02b11e5d85a53b35aa6cea71d4d37a671295a76c02b240e
- MD5 38f9831155956106c61b9885d6113444
- SHA1 8cbc1aaf60edfd4155bb4f10fdb5257d7c4b84f8
- SHA512 e1e3859d83ee49bfdd0ea5b929772426d529e417c7d6d6bbdf251cc3d5ae5a2eaf055d0be62598231a444a5e54a1b0cea5eb60d4140d5e9739210c3b0d667b18
- SSDEEP 24576:/hNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa5:/xKcdPHmMLYpX7T35/fPoGPpGFjztQcR
- TLSH T1FC453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\DisksMacro\FXHP3lsuQaVvk+L1R35MB3Ytt9iB2jA=\vcruntime140_cor3.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\DisksMacro\FXHP3lsuQaVvk+L1R35MB3Ytt9iB2jA=\wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 1c1c5d5ae7530615585b77a8b15588ed51ea66da9a75fceeea7f772970edc01f
- MD5 f344857a45f59103361fd5a5edbdb670
- SHA1 34ce32a1182377e612673add6d2644b9bd723d94
- SHA512 553baf174e8d0b5e8ef4d837a4c16a974b1b52693c3920baa4edc6177a4fc1a05a27923f78d8c3d84f4b7dcfe86b8f50a4ab942045f8afa6087b122b07e64898
- SSDEEP 24576:Dek+C9iX4izlWkFLgcUxwdHaKzhWjl9sIovgbAvJh5A2RwK2Ebie2K9dUghF0+J:4PoKlWkF3CwpaPl1oYbA35A252EbNDxJ
- TLSH T15495494AB6EC40E9C47AD23CDADB461BF63174152761A7CF23A0479D6F27BD00A7A360
- MD5 SHA1 SHA512 SSDEEP TLSH