Overview

overview

9

Static

static

3

Checker.exe

windows10-2004-x64

9

Checker.exe

windows11-ltsc_2024-x64

9

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • user interaction
    yes
  • max time kernel
    51s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/08/2026, 18:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Checker.exe
  • Size 2.1MB
  • Sample260827-wm8t9sysax
  • SHA256 63f5a766fd62d10cf1b2a63324ff2a94ef5703fe8aecdcfc71e20f3b9c8ff137
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionspywarestealertrojan

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies boot configuration data using bcdedit 2 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\Checker.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c dotnet --list-runtimes 2>nul
      2⤵
      • Executes a command shell one-liner
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Program Files\dotnet\dotnet.exe
        dotnet --list-runtimes
        3⤵
        • System Time Discovery
        PID:4528
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit /enum {current}
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5560
      • C:\Windows\system32\bcdedit.exe
        bcdedit /enum {current}
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2044
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5540
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c manage-bde -status C:
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\system32\manage-bde.exe
        manage-bde -status C:
        3⤵
          PID:1164
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c dotnet --list-runtimes 2>nul
        2⤵
        • Executes a command shell one-liner
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Program Files\dotnet\dotnet.exe
          dotnet --list-runtimes
          3⤵
          • System Time Discovery
          PID:5496
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c bcdedit /enum {current}
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Windows\system32\bcdedit.exe
          bcdedit /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:2100
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious use of AdjustPrivilegeToken
          PID:3000
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c manage-bde -status C:
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6024
        • C:\Windows\system32\manage-bde.exe
          manage-bde -status C:
          3⤵
            PID:6072
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1144
      • C:\Windows\system32\mmc.exe
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
        1⤵
          PID:1464
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:5780

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 8952c29ab1da164817c23e2f65604147d672248eb51d5a58d25271b8867a8f56
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_4klqwwbw.zvv.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4klqwwbw.zvv.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1144-26-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-28-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-20-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-22-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-29-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-31-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-30-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/1144-27-0x000001CF25130000-0x000001CF25131000-memory.dmp
                Download

                memory/3000-18-0x0000020B6B410000-0x0000020B6B4C2000-memory.dmp
                Download

                memory/3648-0-0x00007FF6249C0000-0x00007FF624DF7000-memory.dmp
                Download

                memory/4772-9-0x00000291D90B0000-0x00000291D90CE000-memory.dmp
                Download

                memory/4772-6-0x00000291D8E50000-0x00000291D8E72000-memory.dmp
                Download

                memory/4772-10-0x00000291D90D0000-0x00000291D9182000-memory.dmp
                Download

                memory/4772-11-0x00000291D9190000-0x00000291D919A000-memory.dmp
                Download