Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/08/2026, 18:25
General
- Target sample.exe
- Size 380KB
- Sample260814-w2s3csbc58
- SHA256 90a2dd360c4f32579eb13f052fd798dc917dea8f590f8b63835a28f9a52f6dae
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 6 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- System policy modification 1 TTPs 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Windows security bypass
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\ProgramData\Microsoft\{FD46D6B5-FE3C-4BA7-AD88-B011DE3A7A81}\AppCacheHost.exeC:\ProgramData\Microsoft\{FD46D6B5-FE3C-4BA7-AD88-B011DE3A7A81}\AppCacheHost.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
4Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
AppCacheHost.bin
AppCacheHost.exe
svchost.log
svchost.log
svchost.log
svchost.log
svchost.log
svchost.log
svchost.log
svchost.log
svchost.log
memory/1752-88-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-67-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1752-72-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-79-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-77-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-69-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-70-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-71-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-140-0x0000000180000000-0x000000018003C000-memory.dmp
memory/1752-172-0x0000000003290000-0x0000000003291000-memory.dmp
memory/1752-154-0x0000000180000000-0x000000018003C000-memory.dmp
memory/5492-153-0x00007FF661940000-0x00007FF6619A3000-memory.dmp
memory/5492-60-0x00007FF661940000-0x00007FF6619A3000-memory.dmp
memory/5492-57-0x00007FF661940000-0x00007FF6619A3000-memory.dmp
memory/5492-171-0x00007FF661940000-0x00007FF6619A3000-memory.dmp
memory/5492-45-0x00007FF661940000-0x00007FF6619A3000-memory.dmp