Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 12:27
General
- Target WhatsApp Installer.exe
- Size 1.4MB
- Sample260817-pmxnnszeng
- SHA256 1e7f1702722913f00e1c4a8c3d48373d6b40c4c83b25dccb13e84571ae6f7fdd
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WhatsApp Installer.exe"C:\Users\Admin\AppData\Local\Temp\WhatsApp Installer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2630.102.0_x64__cv1g1gvanyjgm\WhatsApp.Root.exe"C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2630.102.0_x64__cv1g1gvanyjgm\WhatsApp.Root.exe"1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp55C7.tmp
memory/4960-25-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-27-0x0000023177D50000-0x0000023177D58000-memory.dmp
memory/4960-3-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-4-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-5-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-6-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-7-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-8-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-26-0x0000023177FD0000-0x0000023177FD8000-memory.dmp
memory/4960-10-0x0000023175ED0000-0x0000023175EDA000-memory.dmp
memory/4960-1-0x000002315B810000-0x000002315B974000-memory.dmp
memory/4960-22-0x0000023176B20000-0x0000023176B5C000-memory.dmp
memory/4960-21-0x0000023176AC0000-0x0000023176AD2000-memory.dmp
memory/4960-23-0x0000023177230000-0x0000023177256000-memory.dmp
memory/4960-2-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-24-0x0000023178170000-0x0000023178698000-memory.dmp
memory/4960-9-0x0000023177170000-0x000002317722A000-memory.dmp
memory/4960-0-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp
memory/4960-28-0x00000231780F0000-0x000002317812E000-memory.dmp
memory/4960-30-0x000002317C6F0000-0x000002317C878000-memory.dmp
memory/4960-29-0x0000023177FC0000-0x0000023177FCE000-memory.dmp
memory/4960-31-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-32-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-35-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-36-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-37-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-38-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-39-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-40-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-53-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-56-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
memory/4960-62-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp