Analysis
- user interaction
yes - max time kernel
104s - max time network
70s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 23:41
General
- Target YouAreAnIdiot-UnFlash.exe
- Size 2.5MB
- Sample260823-3pl7lsbe65
- SHA256 60dc04e2da68bae8d58d05d35e048bc0de72d81ba2fccddf93f0977940c4aeb1
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: LoadsDriver 10 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\AppData\Local\Temp\YouAreAnIdiot-UnFlash.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3864-0-0x00007FFEF623F000-0x00007FFEF6240000-memory.dmp
memory/3864-1-0x000002EADC7E0000-0x000002EADCA6A000-memory.dmp
memory/3864-2-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-6-0x000002EADE840000-0x000002EADE850000-memory.dmp
memory/3864-4-0x000002EADE810000-0x000002EADE844000-memory.dmp
memory/3864-3-0x000002EADE6E0000-0x000002EADE6E8000-memory.dmp
memory/3864-5-0x000002EADE860000-0x000002EADE87A000-memory.dmp
memory/3864-8-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-7-0x000002EADE850000-0x000002EADE864000-memory.dmp
memory/3864-9-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-10-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-11-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-12-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-13-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-14-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-15-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-16-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-17-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-18-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-19-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-20-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-21-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-22-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-23-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp
memory/3864-24-0x00007FFEF60B0000-0x00007FFEF6A54000-memory.dmp