Analysis
- user interaction
yes - max time kernel
84s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AxonPC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
AxonPC.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target AxonPC.exe
- Size 41.7MB
- Sample260815-b85phsxves
- SHA256 1b9599bc3aba0d0f0e8142b0625ebe695dfc37f99cce27c857c624345346065d
- MD5 4afe2961484fc96e18e4ab977f669ad1
- SHA1 09c0a751b2b69d1230a6f77820a910c51aaf533c
- SHA512 835ce176e50bf8d549b56a8fd2ff4491d6c3f0147eb5c50dca8836ba999188d8f142b61e3f4ea39a1ee3e216c8822f52d8a4c458dadf297f483243920d5f1d61
- SSDEEP 786432:aXV+vEX/hBbERTRURg2DUxQYtGQAPD2VBqvJhbvr/lINcXdu/mAYk7:0/hBO2DUxQYtRAb2VBqvbvrdINcB
- TLSH T1F0A7CF16629C02DCE07AF1788687A603E7F17C0D0335EEEB56D15D671F6F6E0AA7A600
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1852 cmd.exe 5088 powercfg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe 1832 AxonPC.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1832 AxonPC.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 5088 powercfg.exe Token: SeCreatePagefilePrivilege 5088 powercfg.exe Token: 33 5380 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5380 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1832 AxonPC.exe 1832 AxonPC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1852 1832 AxonPC.exe 89 PID 1852 wrote to memory of 5088 1852 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\AxonPC.exe"C:\Users\Admin\AppData\Local\Temp\AxonPC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /setactive SCHEME_BALANCED2⤵
- Power Settings
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\system32\powercfg.exepowercfg /setactive SCHEME_BALANCED3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5380