Analysis
- max time kernel
148s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 12:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2.7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2.7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2.7.exe
- Size 54KB
- Sample260905-pnngdsvbjc
- SHA256 265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323
- MD5 cee6789d9a1e821c975a0a2d1369f06e
- SHA1 0c787c22b9d79c422589661efbb6ecd65b46c3af
- SHA512 cb68f5343312a9203e99435c84f13b2e5b769a4422931e518fc7818912c75e05ecdacdf4bbf09eea7b97d31932584ea5a72438b9b7b904c35eafd38aa858e474
- SSDEEP 1536:yrJPmXpYFaCPFCjax+ohiehQW8PwWTuXbpdXT84XmPMv:IPmXpOzAaxcsQ1wpFx84XmEv
- TLSH T17E43083517D242A7FCDBC231CAB4A327F4E17D867BA15A1F0324D9085F67182B5A8AD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4324 wlrmdr.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4696 2.7.exe 4696 2.7.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5976 explorer.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe Token: SeShutdownPrivilege 5976 explorer.exe Token: SeCreatePagefilePrivilege 5976 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4696 wrote to memory of 4400 4696 2.7.exe 59 PID 4696 wrote to memory of 4432 4696 2.7.exe 60 PID 4696 wrote to memory of 2368 4696 2.7.exe 80 PID 4696 wrote to memory of 5976 4696 2.7.exe 81 PID 5976 wrote to memory of 4920 5976 explorer.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4400
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4432
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2368
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2.7.exe"C:\Users\Admin\AppData\Local\Temp\2.7.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
PID:4324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
- Size 54KB
- SHA256 265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323
- MD5 cee6789d9a1e821c975a0a2d1369f06e
- SHA1 0c787c22b9d79c422589661efbb6ecd65b46c3af
- SHA512 cb68f5343312a9203e99435c84f13b2e5b769a4422931e518fc7818912c75e05ecdacdf4bbf09eea7b97d31932584ea5a72438b9b7b904c35eafd38aa858e474
- SSDEEP 1536:yrJPmXpYFaCPFCjax+ohiehQW8PwWTuXbpdXT84XmPMv:IPmXpOzAaxcsQ1wpFx84XmEv
- TLSH T17E43083517D242A7FCDBC231CAB4A327F4E17D867BA15A1F0324D9085F67182B5A8AD3
- MD5 SHA1 SHA512 SSDEEP TLSH