Analysis
- max time kernel
49s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 18:24
General
- Target 2.7.exe
- Size 54KB
- Sample260826-w2ff9svanb
- SHA256 063fb02a19adefb88a47ade0eba990288e2e761f962b9fd202f286c35d579778
Malware Config
Signatures
- Downloads MZ/PE file 5 IoCs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.7.exe"C:\Users\Admin\AppData\Local\Temp\2.7.exe"3⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\j8g5958s.exe"C:\Users\Admin\AppData\Local\Temp\j8g5958s.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ucim\emyq.exe"C:\Users\Admin\AppData\Roaming\Ucim\emyq.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp06119844.bat"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\i1lna5a8.exe"C:\Users\Admin\AppData\Local\Temp\i1lna5a8.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DANG0PX9OL.tmp\i1lna5a8.tmp"C:\Users\Admin\AppData\Local\Temp\is-DANG0PX9OL.tmp\i1lna5a8.tmp" /SL5="$1302F8,3709115,898560,C:\Users\Admin\AppData\Local\Temp\i1lna5a8.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\h6wiq8hf.exe"C:\Users\Admin\AppData\Local\Temp\h6wiq8hf.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\8yuooac4.exe"C:\Users\Admin\AppData\Local\Temp\8yuooac4.exe"4⤵
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\07gwjjzj.exe"C:\Users\Admin\AppData\Local\Temp\07gwjjzj.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vt94re0b.exe"C:\Users\Admin\AppData\Local\Temp\vt94re0b.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\\svchost.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"5⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2103406a.bat"6⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\winlogon.exe"C:\Users\Admin\AppData\Local\Temp\\winlogon.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lsass.exe"C:\Users\Admin\AppData\Local\Temp\\lsass.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f7f13y02.exe"C:\Users\Admin\AppData\Local\Temp\f7f13y02.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaap3dx4.exe"C:\Users\Admin\AppData\Local\Temp\jaap3dx4.exe"4⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Ucim\emyq.exeC:\Users\Admin\AppData\Roaming\Ucim\emyq.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\svchostldq.exeC:\Users\Admin\AppData\Roaming\svchostldq.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\vt94re0b.exeC:\Users\Admin\AppData\Local\Temp\vt94re0b.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\syshost.exeC:\Users\Admin\AppData\Local\Microsoft\syshost.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
1[1].exe
3[1].exe
07gwjjzj.exe
8yuooac4.exe
MsEdgeUpdate.xml
f7f13y02.exe
h6wiq8hf.exe
i1lna5a8.exe
_isdecmp.dll
i1lna5a8.tmp
j8g5958s.exe
svchost.exe
taskhost.exe
tmp06119844.bat
tmp2103406a.bat
vt94re0b.exe
wlrmdr.exe
emyq.exe
memory/556-57-0x0000000003C60000-0x0000000003CA1000-memory.dmp
memory/556-58-0x0000000003C60000-0x0000000003CA1000-memory.dmp
memory/556-59-0x0000000003C60000-0x0000000003CA1000-memory.dmp
memory/556-55-0x0000000003C60000-0x0000000003CA1000-memory.dmp
memory/556-96-0x0000000003C60000-0x0000000003CA1000-memory.dmp
memory/556-13-0x0000000000E40000-0x0000000000E41000-memory.dmp
memory/556-99-0x0000000000E60000-0x0000000000E61000-memory.dmp
memory/556-12-0x0000000180000000-0x0000000180005000-memory.dmp
memory/4372-0-0x0000021D23D10000-0x0000021D23D12000-memory.dmp
memory/5284-70-0x00000000019A0000-0x0000000001B16000-memory.dmp
memory/5284-69-0x0000000001920000-0x0000000001994000-memory.dmp
memory/5284-90-0x00000000042B0000-0x00000000042BC000-memory.dmp
memory/5284-89-0x00000000042E0000-0x0000000004318000-memory.dmp
memory/5284-87-0x0000000002B10000-0x0000000002B3F000-memory.dmp
memory/5284-86-0x00000000027F0000-0x00000000027FD000-memory.dmp
memory/5284-85-0x00000000027D0000-0x00000000027EB000-memory.dmp
memory/5284-83-0x0000000002650000-0x0000000002698000-memory.dmp
memory/5284-91-0x0000000004660000-0x00000000046F9000-memory.dmp
memory/5284-77-0x0000000001E50000-0x0000000001EF9000-memory.dmp
memory/5284-72-0x0000000001B20000-0x0000000001DA3000-memory.dmp
memory/5284-78-0x0000000001F00000-0x0000000001FA7000-memory.dmp
memory/5284-76-0x0000000001DF0000-0x0000000001E1A000-memory.dmp
memory/5284-79-0x0000000001FB0000-0x00000000020C6000-memory.dmp
memory/5284-74-0x0000000001DB0000-0x0000000001DBB000-memory.dmp
memory/5284-73-0x00000000018F0000-0x000000000190A000-memory.dmp
memory/5284-66-0x0000000001010000-0x0000000001706000-memory.dmp
memory/5284-82-0x00000000022D0000-0x000000000264C000-memory.dmp
memory/5284-67-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
memory/5284-75-0x0000000001DC0000-0x0000000001DE7000-memory.dmp
memory/5284-80-0x00000000020D0000-0x0000000002173000-memory.dmp
memory/5284-81-0x0000000002180000-0x00000000022CB000-memory.dmp
memory/5284-60-0x00000000005B0000-0x0000000000677000-memory.dmp
memory/5284-65-0x0000000000FB0000-0x000000000100D000-memory.dmp
memory/5284-63-0x0000000000CD0000-0x0000000000E93000-memory.dmp
memory/5284-64-0x0000000000EF0000-0x0000000000FA2000-memory.dmp
memory/5284-62-0x0000000000B30000-0x0000000000BCD000-memory.dmp
memory/5284-92-0x0000000004700000-0x0000000004726000-memory.dmp
memory/5284-61-0x0000000000680000-0x0000000000A21000-memory.dmp
memory/5284-71-0x00000000018E0000-0x00000000018ED000-memory.dmp
memory/5284-68-0x0000000001740000-0x00000000018D9000-memory.dmp
memory/5284-88-0x0000000004140000-0x000000000415C000-memory.dmp
memory/5284-95-0x0000000005040000-0x0000000005075000-memory.dmp
memory/5284-94-0x0000000004F60000-0x0000000005033000-memory.dmp
memory/5284-93-0x0000000004730000-0x0000000004F5A000-memory.dmp
memory/5284-84-0x00000000026A0000-0x00000000027C1000-memory.dmp
memory/6340-126-0x00000000027D0000-0x00000000027EB000-memory.dmp
memory/6340-105-0x0000000000EF0000-0x0000000000FA2000-memory.dmp
memory/6340-119-0x0000000001F00000-0x0000000001FA7000-memory.dmp
memory/6340-115-0x0000000001DB0000-0x0000000001DBB000-memory.dmp
memory/6340-112-0x00000000018E0000-0x00000000018ED000-memory.dmp
memory/6340-103-0x0000000000B40000-0x0000000000BDD000-memory.dmp
memory/6340-108-0x0000000000EB0000-0x0000000000EB8000-memory.dmp
memory/6340-102-0x0000000000690000-0x0000000000A31000-memory.dmp
memory/6340-110-0x0000000001920000-0x0000000001994000-memory.dmp
memory/6340-114-0x00000000018F0000-0x000000000190A000-memory.dmp
memory/6340-116-0x0000000001DC0000-0x0000000001DE7000-memory.dmp
memory/6340-117-0x0000000001DF0000-0x0000000001E1A000-memory.dmp
memory/6340-104-0x0000000000CE0000-0x0000000000EA3000-memory.dmp
memory/6340-121-0x00000000020D0000-0x0000000002173000-memory.dmp
memory/6340-124-0x0000000002650000-0x0000000002698000-memory.dmp
memory/6340-127-0x00000000028F0000-0x00000000028FD000-memory.dmp
memory/6340-128-0x0000000002B10000-0x0000000002B3F000-memory.dmp
memory/6340-129-0x0000000004130000-0x000000000414C000-memory.dmp
memory/6340-106-0x0000000000FB0000-0x000000000100D000-memory.dmp
memory/6340-101-0x00000000005C0000-0x0000000000687000-memory.dmp