Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 09:06
General
- Target 68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15.exe
- Size 1.6MB
- Sample260825-k24cjswtay
- SHA256 68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15.exe"C:\Users\Admin\AppData\Local\Temp\68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E43.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15.exe"C:\Users\Admin\AppData\Local\Temp\68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "[bool](Get-AppxPackage | Where-Object { $_.PackageFamilyName -like 'AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga' })"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "(Get-AppxPackage | Where-Object { $_.PackageFamilyName -eq 'AdobeSystemsIncorporated.AdobePhotoshopExpress_mtcwf2zmmt10c' -and -not $_.IsFramework } | Select-Object -First 1 -ExpandProperty Version)"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MicrosoftEdgeUpdateBroker.exe
vcredist_x86.exe
StartupProfileData-NonInteractive
$$a5E43.bat
68de0e5e2a580b79062977c0dee905f7f91fabe085280e42c9dcc7f747bcce15.exe.exe
Adobe_GDE.log
__PSScriptPolicyTest_aqz3bh34.3dn.ps1
Logo1_.exe
_desktop.ini
memory/1196-21-0x00000000002D0000-0x0000000000752000-memory.dmp
memory/1196-96-0x00000000002D0000-0x0000000000752000-memory.dmp
memory/1196-86-0x00000000002D0000-0x0000000000752000-memory.dmp
memory/1408-79-0x0000000005B00000-0x0000000005E5B000-memory.dmp
memory/1408-83-0x000000006C0C0000-0x000000006C10C000-memory.dmp
memory/2168-0-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2168-13-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-103-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-5118-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-95-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-10-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-109-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-425-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-82-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-1319-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4612-5593-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5012-54-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/5012-73-0x0000000007E60000-0x0000000007E6A000-memory.dmp
memory/5012-71-0x0000000006E70000-0x0000000006E78000-memory.dmp
memory/5012-74-0x0000000007E80000-0x0000000007E88000-memory.dmp
memory/5012-75-0x0000000007EF0000-0x0000000007F16000-memory.dmp
memory/5012-72-0x0000000007E40000-0x0000000007E46000-memory.dmp
memory/5012-70-0x0000000007EC0000-0x0000000007EEA000-memory.dmp
memory/5012-69-0x0000000007E10000-0x0000000007E2A000-memory.dmp
memory/5012-68-0x0000000007FC0000-0x00000000081C4000-memory.dmp
memory/5012-67-0x0000000007C00000-0x0000000007C1A000-memory.dmp
memory/5012-66-0x0000000008260000-0x00000000088DC000-memory.dmp
memory/5012-65-0x0000000007A80000-0x0000000007B23000-memory.dmp
memory/5012-64-0x0000000006E60000-0x0000000006E80000-memory.dmp
memory/5012-61-0x000000006C0C0000-0x000000006C10C000-memory.dmp
memory/5012-60-0x0000000007A30000-0x0000000007A66000-memory.dmp
memory/5012-59-0x00000000068A0000-0x00000000068EC000-memory.dmp
memory/5012-58-0x0000000006850000-0x000000000686E000-memory.dmp
memory/5012-57-0x0000000006470000-0x00000000067CB000-memory.dmp
memory/5012-53-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/5012-52-0x0000000005B70000-0x0000000005B92000-memory.dmp
memory/5012-51-0x0000000005BA0000-0x00000000061EA000-memory.dmp
memory/5012-50-0x0000000003380000-0x00000000033B6000-memory.dmp