Overview

overview

7

Static

static

3

7ef7761126...ee.exe

windows10-2004-x64

7

7ef7761126...ee.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 22:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7ef7761126f2dee21c5d0ea764a51e529ac48c539c66f8f95206999fd0262dee.exe
  • Size 11.0MB
  • Sample260826-15g7gsbq21
  • SHA256 7ef7761126f2dee21c5d0ea764a51e529ac48c539c66f8f95206999fd0262dee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 35 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ef7761126f2dee21c5d0ea764a51e529ac48c539c66f8f95206999fd0262dee.exe
    "C:\Users\Admin\AppData\Local\Temp\7ef7761126f2dee21c5d0ea764a51e529ac48c539c66f8f95206999fd0262dee.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\7ef7761126f2dee21c5d0ea764a51e529ac48c539c66f8f95206999fd0262dee.exe
      C:\Users\Admin\AppData\Local\Temp\7ef7761126f2dee21c5d0ea764a51e529ac48c539c66f8f95206999fd0262dee.exe
      2⤵
      • Loads dropped DLL
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4192
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:888

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\VCRUNTIME140.dll
          • Size 174KB
          • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_bz2.pyd
          • Size 84KB
          • SHA256 261545bd24f15a783fc0c82568b766a4ab569dde14507a81701cccf5293e6e54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_ctypes.pyd
          • Size 131KB
          • SHA256 9d6dccb4cd84a44a107f9b06b91c0a44e85766d9bf4debb6abbde8fda7494c2c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_elementtree.pyd
          • Size 132KB
          • SHA256 26c5c2f3f2b8dac1499f07a50d7afd14315c20a6a541abbe4e306bcd9df404f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_hashlib.pyd
          • Size 67KB
          • SHA256 79a26289aef0d92545a082507c7021f10e219621d137cb726c4d0fbbfd4b46ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_lzma.pyd
          • Size 155KB
          • SHA256 ee224aacf5cf9c9974a1b842aac8d89d5d9b7eeebbf4d76619ae0ce4da8ecd96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_queue.pyd
          • Size 34KB
          • SHA256 4404c2569443ffb54e7cfffdca8ddf58c9a609175305970728ec12bc1c147b43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_socket.pyd
          • Size 84KB
          • SHA256 ccbd0f83df3784da08147b8e8765e28c978de28b5c0eddcfba5567b59d43fef9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_sqlite3.pyd
          • Size 128KB
          • SHA256 4c5fa9341a76ac525fd36e2cb23260934ad9b9f6825725ff139b26c8dc72436d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_ssl.pyd
          • Size 177KB
          • SHA256 8d2f51fa1dc929073a2ad8d1c7c0c911e8f695870dcf4dda2846f4b75a7f77fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_tkinter.pyd
          • Size 68KB
          • SHA256 38284c64fe4c6b376fefc0f0b341815cd37b77e0f24d53ddb4dd48ea3c680274
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\_uuid.pyd
          • Size 27KB
          • SHA256 b93832742a2348d6659fd62e8a8aff061594693fc537da74c7d2d1cdf83a8475
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\libssl-3.dll
          • Size 776KB
          • SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          main.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\main.dll
          • Size 11.5MB
          • SHA256 0e8d9fbe0f7336b07ebd802ecc4731e0866741b87c5c65452ed4af548729b0b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\pyexpat.pyd
          • Size 216KB
          • SHA256 b9c9c5a9f52af559a7eb4e8ddfd60558185bfc7794f32840bed1747d1ec9026a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\python3.dll
          • Size 70KB
          • SHA256 76e7fd69a01081726308317d6e502721c2ba6792b48880dc1ef649c755788db7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\python313.dll
          • Size 5.9MB
          • SHA256 e820bf024efd2b56bb2b82791e6b6ddc7303f070f8e72cba7637482a8a906238
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\pywintypes313.dll
          • Size 133KB
          • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\select.pyd
          • Size 32KB
          • SHA256 024f955349fe46cf1bb2c22c6b57fcf38cf5755d46166fbf63e7e5b92433b111
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\sqlite3.dll
          • Size 1.5MB
          • SHA256 c6812eaf0f8605df273b9bf7e359b83fd65038ecc66455c3f7a933768cb92f3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\tcl86t.dll
          • Size 1.8MB
          • SHA256 5459c39b952ea58a1eff6d926200050044e656b456c35cddb27e1f022f82a6bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\tk86t.dll
          • Size 1.5MB
          • SHA256 bdcca44af0fde93dde0275dda6eaf9f871dc944401b219da0547bdc21a33af78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\win32api.pyd
          • Size 135KB
          • SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32clipboard.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\win32clipboard.pyd
          • Size 28KB
          • SHA256 6923de81e3bdb90be043b66bb6ddd91c7db0be3aa221eeff5ecfc1077cbf92ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\win32crypt.pyd
          • Size 123KB
          • SHA256 773c9f0ef15a6b4fffb3d8748ceb3d1e062616f29aa18fbccfb5f6df23493a46
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32gui.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\win32gui.pyd
          • Size 218KB
          • SHA256 b021c6ab915fd9370c659aebc90db1b52b3da7ccf61420687d40ff7eb813f20e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32process.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\win32process.pyd
          • Size 52KB
          • SHA256 05dc1c58c825d0282194b34ff519b3fe29083324b59e0ff06d73f0ed8c890c98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1224_008908_X7VrZLCAYkg\zlib1.dll
          • Size 144KB
          • SHA256 606aa270884af094f9a5f5ebe476e29a1aa0d2c961a9f3b9c795eee3a09be686
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4192-1045-0x000002F37AD70000-0x000002F37AD71000-memory.dmp
          Download

          memory/4192-1048-0x00007FFED0160000-0x00007FFED0189000-memory.dmp
          Download