Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 14:07
General
- Target c7fc53939ef44d1702fc6d438268b08783472538dff5f77eda4ded0f913ebd22.exe
- Size 1.9MB
- Sample260822-re76jsvfkh
- SHA256 c7fc53939ef44d1702fc6d438268b08783472538dff5f77eda4ded0f913ebd22
Malware Config
Signatures
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7fc53939ef44d1702fc6d438268b08783472538dff5f77eda4ded0f913ebd22.exe"C:\Users\Admin\AppData\Local\Temp\c7fc53939ef44d1702fc6d438268b08783472538dff5f77eda4ded0f913ebd22.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\newdev.exe"C:\Windows\System32\newdev.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C7FC53~1.EXE >> NUL2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3212-0-0x00007FF64AE60000-0x00007FF64B04A000-memory.dmp
memory/3416-2-0x0000021D01D10000-0x0000021D01EC6000-memory.dmp
memory/3416-3-0x0000021D039B0000-0x0000021D039D0000-memory.dmp
memory/3416-5-0x0000021D039B0000-0x0000021D039D0000-memory.dmp
memory/3416-19-0x0000021D039B0000-0x0000021D039D0000-memory.dmp
memory/3416-18-0x0000000180000000-0x00000001801A2000-memory.dmp
memory/3416-17-0x0000000180000000-0x00000001801A2000-memory.dmp
memory/3416-20-0x0000000180000000-0x00000001801A2000-memory.dmp
memory/3416-8-0x0000000180000000-0x00000001801A2000-memory.dmp
memory/3416-21-0x0000000180000000-0x00000001801A2000-memory.dmp
memory/3416-26-0x0000000180000000-0x00000001801A2000-memory.dmp