Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
06/09/2026, 07:10
General
- Target 2ff8ad6d097475654fb7b835cab452b4.exe
- Size 6.0MB
- Sample260906-hzq84aaa78
- SHA256 d21bd3d35a440b59d7bffc3111dae5db43895d09d6d33caa47ca6fb205bc07fa
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 18 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ff8ad6d097475654fb7b835cab452b4.exe"C:\Users\Admin\AppData\Local\Temp\2ff8ad6d097475654fb7b835cab452b4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\icacls.exeC:\Windows\System32\icacls.exe C:\ProgramData\MiramaroRunner\runs\4d3bafadb3de939bf9289a25c2246402 /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F2⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\ProgramData\MiramaroRunner\runs\4d3bafadb3de939bf9289a25c2246402\runner.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
runner.ps1
sstp-cert.cer
__PSScriptPolicyTest_eclsmect.4cb.ps1
memory/1132-33-0x000002CD1BCF0000-0x000002CD1BD1A000-memory.dmp
memory/1132-37-0x000002CD1BCC0000-0x000002CD1BCDE000-memory.dmp
memory/1132-16-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-17-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-18-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-19-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-20-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-22-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-14-0x000002CD1B8D0000-0x000002CD1B8F2000-memory.dmp
memory/1132-23-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-24-0x000002CD1BD70000-0x000002CD1BF32000-memory.dmp
memory/1132-25-0x000002CD1C470000-0x000002CD1C998000-memory.dmp
memory/1132-31-0x000002CD1BC00000-0x000002CD1BCB2000-memory.dmp
memory/1132-32-0x000002CD1BBC0000-0x000002CD1BBCA000-memory.dmp
memory/1132-34-0x000002CD1BCF0000-0x000002CD1BD14000-memory.dmp
memory/1132-9-0x00007FFB9D94F000-0x00007FFB9D950000-memory.dmp
memory/1132-15-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-11-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-30-0x000002CD1BBE0000-0x000002CD1BBFE000-memory.dmp
memory/1132-38-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-39-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-40-0x000002CD1BBF0000-0x000002CD1BBFA000-memory.dmp
memory/1132-41-0x000002CD1BD00000-0x000002CD1BD1C000-memory.dmp
memory/1132-42-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-43-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-49-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-50-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-51-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-52-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-53-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-59-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-66-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/1132-10-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp