Analysis
- user interaction
yes - max time kernel
54s - max time network
47s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/08/2026, 03:19
General
- Target 筛选软件20251125.exe
- Size 22.8MB
- Sample260822-dt53vaea89
- SHA256 f30c6d7e493a57b5a99a8e62412b43954a84f6b0ca7bbfbb802dcf4176429a50
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\筛选软件20251125.exe"C:\Users\Admin\AppData\Local\Temp\筛选软件20251125.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 21242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1516 -ip 15161⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
E2EECore.3.5.241231.dll
ÅäÖÃ.ini
memory/1516-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-49-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-46-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-44-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-41-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-37-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-35-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-33-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-31-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-29-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-27-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-25-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-23-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-21-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-19-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-39-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-11-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-6-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-5-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-7-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-53-0x0000000004630000-0x0000000004631000-memory.dmp
memory/1516-9-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1516-205-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4728-206-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-208-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-207-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-218-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-217-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-216-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-215-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-214-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-212-0x0000023999D20000-0x0000023999D21000-memory.dmp
memory/4728-213-0x0000023999D20000-0x0000023999D21000-memory.dmp