Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/09/2026, 07:30
General
- Target ed81fa56c94b12750ccb2d6bf264e313f570c4c5e39a181b5d5dd170678971a5.exe
- Size 1.2MB
- Sample260909-jb73datekf
- SHA256 ed81fa56c94b12750ccb2d6bf264e313f570c4c5e39a181b5d5dd170678971a5
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ed81fa56c94b12750ccb2d6bf264e313f570c4c5e39a181b5d5dd170678971a5.exe"C:\Users\Admin\AppData\Local\Temp\ed81fa56c94b12750ccb2d6bf264e313f570c4c5e39a181b5d5dd170678971a5.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\convert.execonvert.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Muscles.ppam Muscles.ppam.bat && Muscles.ppam.bat3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"4⤵
-
-
C:\Windows\system32\extrac32.exeextrac32 /Y False.ppam *.*4⤵
-
-
C:\Windows\system32\findstr.exefindstr /V "authorities" Scenes4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\345071\Initially.scrInitially.scr g4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "GuardianSphereX" /tr " pcalua.exe -a 'C:\Users\Admin\AppData\Local\SphereGuard Systems Inc\GuardianSphereX.lnk'" /sc onlogon /F /RL HIGHEST5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\waitfor.exewaitfor /T 15 cXTzqNfeeauQxIwjqTg4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Acer" /tr " pcalua.exe -a 'C:\Users\Admin\AppData\Local\SphereGuard Systems Inc\GuardianSphereX.lnk'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Acer" /tr " pcalua.exe -a 'C:\Users\Admin\AppData\Local\SphereGuard Systems Inc\GuardianSphereX.lnk'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\pcalua.exepcalua.exe1⤵
-
C:\Windows\system32\pcalua.exepcalua.exe -a "C:\Users\Admin\AppData\Local\SphereGuard Systems Inc\GuardianSphereX.lnk"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SphereGuard Systems Inc\GuardianSphereX.bat"C:\Users\Admin\AppData\Local\SphereGuard Systems Inc\GuardianSphereX.bat" e2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
GuardianSphereX.lnk
Initially.scr
g
Adding
Camcorder
Conventions
Creating
Dayton
Dozen
Em.ppam
Ethical
False.ppam
Imports.ppam
Ln
Muscles.ppam
Orchestra
Person.ppam
Rock
Scenes
memory/4848-72-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-84-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-76-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-75-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-78-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-80-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-82-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-81-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-79-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-73-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-90-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-92-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-91-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-89-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-88-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-87-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-86-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-85-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-83-0x00000000002B0000-0x000000000031F000-memory.dmp
memory/4848-74-0x00000000002B0000-0x000000000031F000-memory.dmp