Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dx11.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
dx11.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target dx11.exe
- Size 200KB
- Sample260910-pk3rxawxe1
- SHA256 eca839a2ea6b2a2d3172cfe1ed0d944dcf2256fa07d7518aa4416d3d5043bd1e
- MD5 85d4e6f8852938c677dcbe176e4246fd
- SHA1 c9ca14b328f1bb33d64e318480860e4c2ee007ea
- SHA512 2d168dd5013e017df0eccdba07c5850b54005f2434a33c1695066dd6bf01bcab62348178716a9b4298ea37cf5e92702a8031474f176385ac44b483a06daa24f1
- SSDEEP 6144:PfIOlU0Y/Jx9G89ca6k6Fnj5TObqpecYdBFyHPzLwq+gKM:HGbvmLwq5K
- TLSH T178144A1AAA550138E5A7C179CED68843FB733C4D0B35D9EB03905AB25E73AD0AE39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1684 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2004 d3d9.24344.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 948 icacls.exe 672 icacls.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
pid Process 1684 powershell.exe 1532 powershell.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 1532 powershell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d3d9.24344.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString d3d9.24344.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 powershell.exe 1684 powershell.exe 1532 powershell.exe 1532 powershell.exe 1532 powershell.exe 1532 powershell.exe 1532 powershell.exe 1532 powershell.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4104 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1684 powershell.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 4104 taskmgr.exe Token: SeSystemProfilePrivilege 4104 taskmgr.exe Token: SeCreateGlobalPrivilege 4104 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4104 taskmgr.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3184 wrote to memory of 2004 3184 dx11.exe 88 PID 3184 wrote to memory of 1684 3184 dx11.exe 89 PID 1684 wrote to memory of 1144 1684 powershell.exe 92 PID 2004 wrote to memory of 672 2004 d3d9.24344.exe 93 PID 2004 wrote to memory of 948 2004 d3d9.24344.exe 95 PID 2004 wrote to memory of 1532 2004 d3d9.24344.exe 97 PID 1532 wrote to memory of 124 1532 powershell.exe 99 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1144 attrib.exe 124 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dx11.exe"C:\Users\Admin\AppData\Local\Temp\dx11.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\d3d9.24344.exe"C:\Users\Admin\AppData\Local\Temp\\d3d9.24344.exe" --go "C:\Users\Admin\AppData\Local\Temp\dx11.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SYSTEM32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb" /grant Everyone:F /T /Q3⤵
- Modifies file permissions
PID:672
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb" /grant Everyone:F /T /Q3⤵
- Modifies file permissions
PID:948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$p=Get-Process -Id 2004;$p.PriorityClass='Idle';$f='C:\Users\Admin\AppData\Local\Temp\d3d9.24344.exe';$o='C:\Users\Admin\AppData\Local\Temp\dx11.exe';do { Start-Sleep 0.3 } while(Get-Process -Id 2004 -ErrorAction SilentlyContinue);attrib +h +s $f;Remove-Item $f -Force;if(Test-Path $o){ attrib +h +s $o; Remove-Item $o -Force }"3⤵
- Hide Artifacts: Hidden Files and Directories
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Temp\d3d9.24344.exe4⤵
- Views/modifies file attributes
PID:124
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f='C:\Users\Admin\AppData\Local\Temp\dx11.exe';Start-Sleep 1;attrib +h +s $f;Remove-Item $f -Force"2⤵
- Deletes itself
- Hide Artifacts: Hidden Files and Directories
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Temp\dx11.exe3⤵
- Views/modifies file attributes
PID:1144
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4104
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
3Hidden Files and Directories
2Ignore Process Interrupts
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e7183def1d29fd0395cd78b009e2f8b5e4f480395cf2985ccbc0322108a84822
- MD5 29306a677d74adb5fff04743e73442dc
- SHA1 c5dc81d098e4886febc7d7945933aff03157db88
- SHA512 b91331628ce3096d47af64b27e4ca74a0d6ad7aeecbde9afe14d0ee73c380c5e6f262b8fa3fa7177b83c408f05d1a38acb9e3a4c9e32f9fc698225221918f2be
- TLSH T1A9217F37B3DC8714DC9A413A50CDAC1036B5C7D7419ECF6B7B84D544B42F599DE61150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\d3d9.24344.exe
- Size 200KB
- SHA256 eca839a2ea6b2a2d3172cfe1ed0d944dcf2256fa07d7518aa4416d3d5043bd1e
- MD5 85d4e6f8852938c677dcbe176e4246fd
- SHA1 c9ca14b328f1bb33d64e318480860e4c2ee007ea
- SHA512 2d168dd5013e017df0eccdba07c5850b54005f2434a33c1695066dd6bf01bcab62348178716a9b4298ea37cf5e92702a8031474f176385ac44b483a06daa24f1
- SSDEEP 6144:PfIOlU0Y/Jx9G89ca6k6Fnj5TObqpecYdBFyHPzLwq+gKM:HGbvmLwq5K
- TLSH T178144A1AAA550138E5A7C179CED68843FB733C4D0B35D9EB03905AB25E73AD0AE39713
- MD5 SHA1 SHA512 SSDEEP TLSH