Analysis
- max time kernel
104s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
18/08/2026, 08:44
General
- Target Прайс радіостанції.xls
- Size 1010KB
- Sample260818-knn1psgn4x
- SHA256 ae7d127c7e1804f6e0777b47d773f80165529d6e2cbbecce0328f5ef952406d5
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 40 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 28 IoCs
- Suspicious use of SendNotifyMessage 10 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Прайс радіостанції.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exeC:\Windows\system32\taskkill.exe /f /IM explorer.exe2⤵
- Process spawned unexpected child process
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Process spawned unexpected child process
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
icon.png
PSReadLineCore.dll
b8ab77100df80ab2.customDestinations-ms
memory/1280-110-0x000001D0001E0000-0x000001D0002E0000-memory.dmp
memory/1280-158-0x000001D001C60000-0x000001D001C80000-memory.dmp
memory/1280-172-0x000001D014280000-0x000001D0142A0000-memory.dmp
memory/1280-143-0x000001D001E20000-0x000001D001F20000-memory.dmp
memory/1280-142-0x000001D001A20000-0x000001D001A40000-memory.dmp
memory/3288-286-0x000000001EC30000-0x000000001EC80000-memory.dmp
memory/3288-276-0x0000000028130000-0x0000000028658000-memory.dmp
memory/3288-280-0x000000001EB40000-0x000000001EBEA000-memory.dmp
memory/3288-281-0x000000001EAB0000-0x000000001EAC2000-memory.dmp
memory/3288-282-0x000000001EBF0000-0x000000001EC22000-memory.dmp
memory/3288-287-0x000000001ED40000-0x000000001EDF2000-memory.dmp
memory/3288-107-0x0000000020D60000-0x0000000020F22000-memory.dmp
memory/3288-106-0x000000001F460000-0x000000001F47A000-memory.dmp
memory/3288-290-0x000000001ED20000-0x000000001ED32000-memory.dmp
memory/3288-291-0x000000001F0C0000-0x000000001F0FC000-memory.dmp
memory/3340-43-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-103-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-61-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-60-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-48-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-44-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-68-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-71-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-70-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-69-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-67-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-66-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-72-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-75-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-74-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-77-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-76-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-73-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-78-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-82-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-83-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-84-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-85-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-50-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-102-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-65-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-53-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-0-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-33-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-30-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-32-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-13-0x00007FFDD0D50000-0x00007FFDD0D60000-memory.dmp
memory/3340-10-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-12-0x00007FFDD0D50000-0x00007FFDD0D60000-memory.dmp
memory/3340-11-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-8-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-9-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-7-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-5-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-4-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-6-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-2-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-289-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-3-0x00007FFE1305F000-0x00007FFE13060000-memory.dmp
memory/3340-1-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-292-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp
memory/3340-306-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-305-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-304-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-303-0x00007FFDD3040000-0x00007FFDD3050000-memory.dmp
memory/3340-307-0x00007FFE12F00000-0x00007FFE13163000-memory.dmp