Analysis
- user interaction
yes - max time kernel
210s - max time network
208s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/08/2026, 17:20
General
- Target EDP-50-ANOS-COMPLETO.scr
- Size 70.4MB
- Sample260812-vwtahaea39
- SHA256 7592e7486790e413d07c14c6bfe74df764724735f230043a33bd23cb808af0c8
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EDP-50-ANOS-COMPLETO.scr"C:\Users\Admin\AppData\Local\Temp\EDP-50-ANOS-COMPLETO.scr" /S1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML.bak
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
memory/1124-61-0x00000257B2E10000-0x00000257B2E30000-memory.dmp
memory/1124-13-0x00000257B1340000-0x00000257B1570000-memory.dmp
memory/1124-29-0x00000257AD4A0000-0x00000257AD4C0000-memory.dmp
memory/1124-37-0x000002984B0B0000-0x000002984B8E0000-memory.dmp
memory/1124-41-0x00000257AECB0000-0x00000257AECD0000-memory.dmp
memory/1124-5-0x00000257B0060000-0x00000257B0CF0000-memory.dmp
memory/1124-57-0x00000257B17B0000-0x00000257B17D0000-memory.dmp
memory/1124-53-0x00000257AECD0000-0x00000257AECE0000-memory.dmp
memory/1124-81-0x00000257B3050000-0x00000257B3080000-memory.dmp
memory/1124-88-0x000002984D2F0000-0x000002984D400000-memory.dmp
memory/1124-92-0x00000257B3080000-0x00000257B30D0000-memory.dmp
memory/1124-100-0x00000257B3280000-0x00000257B32B0000-memory.dmp
memory/1124-108-0x00000257B32E0000-0x00000257B3300000-memory.dmp
memory/1124-124-0x000002984D530000-0x000002984D540000-memory.dmp
memory/1124-140-0x000002984E9C0000-0x000002984EA10000-memory.dmp
memory/1124-25-0x00000257B2A30000-0x00000257B2D10000-memory.dmp
memory/1124-22-0x0000029849B90000-0x000002984A880000-memory.dmp
memory/1124-33-0x00000257B1070000-0x00000257B10B0000-memory.dmp
memory/1124-149-0x000002984F2D0000-0x000002984F340000-memory.dmp
memory/1124-136-0x000002984E6C0000-0x000002984E6E0000-memory.dmp
memory/1124-132-0x000002984E8B0000-0x000002984E970000-memory.dmp
memory/1124-128-0x000002984E740000-0x000002984E790000-memory.dmp
memory/1124-120-0x000002984D5D0000-0x000002984D600000-memory.dmp
memory/1124-116-0x000002984D560000-0x000002984D580000-memory.dmp
memory/1124-112-0x00000257B32B0000-0x00000257B32C0000-memory.dmp
memory/1124-104-0x000002984D490000-0x000002984D520000-memory.dmp
memory/1124-96-0x000002984DF20000-0x000002984E6C0000-memory.dmp
memory/1124-17-0x00000257AF250000-0x00000257AF3B0000-memory.dmp
memory/1124-77-0x00000257B2FE0000-0x00000257B3000000-memory.dmp
memory/1124-73-0x00000257B2E50000-0x00000257B2E70000-memory.dmp
memory/1124-69-0x00000257B2F60000-0x00000257B2FA0000-memory.dmp
memory/1124-65-0x00000257B2ED0000-0x00000257B2F20000-memory.dmp
memory/1124-49-0x00000257B1770000-0x00000257B1790000-memory.dmp
memory/1124-45-0x00000257B2D90000-0x00000257B2E10000-memory.dmp
memory/1124-162-0x000002984F550000-0x000002984F560000-memory.dmp
memory/1124-10-0x0000029847F40000-0x0000029848EA0000-memory.dmp