Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 08:52
General
- Target 3880a633f0cf3358a84dc02bcd15e45a026c436da0ea2483157c40f828623e51.exe
- Size 17.6MB
- Sample260814-ks87fage43
- SHA256 3880a633f0cf3358a84dc02bcd15e45a026c436da0ea2483157c40f828623e51
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3880a633f0cf3358a84dc02bcd15e45a026c436da0ea2483157c40f828623e51.exe"C:\Users\Admin\AppData\Local\Temp\3880a633f0cf3358a84dc02bcd15e45a026c436da0ea2483157c40f828623e51.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hjba.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\3880a633f0cf3358a84dc02bcd15e45a026c436da0ea2483157c40f828623e51.exe'; $s.Save()"2⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4880-23-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-22-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-26-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-12-0x00007FFEF623F000-0x00007FFEF6240000-memory.dmp
memory/4880-15-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-17-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-16-0x0000027BCD170000-0x0000027BCD192000-memory.dmp
memory/4880-18-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-19-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-20-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4880-21-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/4980-38-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-32-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-27-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-0-0x0000000003240000-0x0000000003241000-memory.dmp
memory/4980-28-0x0000000003240000-0x0000000003241000-memory.dmp
memory/4980-29-0x0000000004730000-0x0000000004BA6000-memory.dmp
memory/4980-31-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-1-0x0000000004730000-0x0000000004BA6000-memory.dmp
memory/4980-35-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-36-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-2-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-39-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-41-0x0000000000400000-0x00000000015B9000-memory.dmp
memory/4980-42-0x0000000000400000-0x00000000015B9000-memory.dmp