Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 15:08
General
- Target d162edb46dcf377cf73518ac4c251a8cf63442889c77b84968074abf2e1fab99.exe
- Size 857KB
- Sample260817-sh2cvaca97
- SHA256 d162edb46dcf377cf73518ac4c251a8cf63442889c77b84968074abf2e1fab99
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 43 IoCs
- Adds Run key to start application 2 TTPs 43 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 41 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d162edb46dcf377cf73518ac4c251a8cf63442889c77b84968074abf2e1fab99.exe"C:\Users\Admin\AppData\Local\Temp\d162edb46dcf377cf73518ac4c251a8cf63442889c77b84968074abf2e1fab99.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\6920.vbs"2⤵
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win72⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win73⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win74⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win75⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win76⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win77⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win78⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win79⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win710⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win711⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win712⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win713⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win714⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win715⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win716⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win717⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win718⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win719⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win720⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win721⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win722⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win72⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win73⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win74⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win75⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win76⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win77⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win78⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win79⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win710⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win711⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win712⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win713⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win714⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win715⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win716⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win717⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win718⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win719⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win720⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogin.exeC:\Windows\winlogin.exe Win721⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
6920.vbs
winlogin.exe
memory/616-2-0x0000000000400000-0x000000000084E000-memory.dmp
memory/616-0-0x0000000000400000-0x000000000084E000-memory.dmp
memory/892-56-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1000-117-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1284-21-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1404-80-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1572-96-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1804-104-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1936-33-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1984-115-0x0000000000400000-0x000000000084E000-memory.dmp
memory/1988-99-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2196-110-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2200-49-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2240-68-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2240-75-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2332-37-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2364-91-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2516-83-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2552-46-0x0000000000400000-0x000000000084E000-memory.dmp
memory/2552-53-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3116-125-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3172-7-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3172-121-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3172-55-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3172-63-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3172-10-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3232-94-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3932-30-0x0000000000400000-0x000000000084E000-memory.dmp
memory/3932-24-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4276-72-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4296-120-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4388-20-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4388-28-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4612-36-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4612-43-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4644-69-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4656-88-0x0000000000400000-0x000000000084E000-memory.dmp
memory/4900-102-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5060-47-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5352-131-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5656-86-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5668-112-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5696-62-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5788-59-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5812-39-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5828-128-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5896-123-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5936-78-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5940-107-0x0000000000400000-0x000000000084E000-memory.dmp
memory/5992-25-0x0000000000400000-0x000000000084E000-memory.dmp
memory/6080-118-0x0000000000400000-0x000000000084E000-memory.dmp
memory/6080-19-0x0000000000400000-0x000000000084E000-memory.dmp
memory/6080-5-0x0000000000400000-0x000000000084E000-memory.dmp
memory/6080-60-0x0000000000400000-0x000000000084E000-memory.dmp
memory/6128-66-0x0000000000400000-0x000000000084E000-memory.dmp
memory/6128-58-0x0000000000400000-0x000000000084E000-memory.dmp