Analysis
- user interaction
yes - max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 08:50
General
- Target System32.exe
- Size 9.1MB
- Sample260913-krtqcseq7t
- SHA256 69ca6c2a6438dab8a55b1ae87ab1a4f14273dbfb3caf10cf2c8630423345ffad
Malware Config
Signatures
- Possible privilege escalation attempt 2 IoCs
- Loads dropped DLL 8 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\takeown.exetakeown /f C:\Windows\System32 /r /d y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Windows\System32 /grant administrators:F /t /c /l3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\*3⤵
- Drops file in System32 directory
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
ucrtbase.dll
memory/476-76-0x00007FF65BCC0000-0x00007FF65BD2F000-memory.dmp
memory/476-77-0x00007FFB5FA60000-0x00007FFB5FB27000-memory.dmp
memory/476-78-0x00007FFB5E040000-0x00007FFB5E3E1000-memory.dmp
memory/2072-91-0x00007FFB5E5C0000-0x00007FFB5E6E1000-memory.dmp
memory/2072-93-0x00007FFB5EB60000-0x00007FFB5EB8F000-memory.dmp
memory/2072-89-0x00007FFB5E040000-0x00007FFB5E3E1000-memory.dmp
memory/2072-88-0x00007FFB5FA60000-0x00007FFB5FB27000-memory.dmp
memory/2072-90-0x00007FFB60A00000-0x00007FFB60A2A000-memory.dmp
memory/2072-92-0x00007FFB60490000-0x00007FFB60542000-memory.dmp
memory/2072-94-0x00007FFB5F5E0000-0x00007FFB5F95C000-memory.dmp
memory/5416-86-0x00007FFB5F5E0000-0x00007FFB5F95C000-memory.dmp
memory/5416-85-0x00007FFB5D860000-0x00007FFB5D886000-memory.dmp
memory/5416-82-0x00007FFB5E5C0000-0x00007FFB5E6E1000-memory.dmp
memory/5416-79-0x00007FFB5FA60000-0x00007FFB5FB27000-memory.dmp
memory/5416-87-0x00007FFB5CE70000-0x00007FFB5CE8A000-memory.dmp
memory/5416-81-0x00007FFB60A00000-0x00007FFB60A2A000-memory.dmp
memory/5416-83-0x00007FFB60490000-0x00007FFB60542000-memory.dmp
memory/5416-80-0x00007FFB5E040000-0x00007FFB5E3E1000-memory.dmp
memory/5416-84-0x00007FFB5EB60000-0x00007FFB5EB8F000-memory.dmp
memory/5980-95-0x00007FFB5FA60000-0x00007FFB5FB27000-memory.dmp
memory/5980-97-0x00007FFB5F5E0000-0x00007FFB5F95C000-memory.dmp
memory/5980-99-0x00007FFB60A00000-0x00007FFB60A2A000-memory.dmp
memory/5980-100-0x00007FFB5E5C0000-0x00007FFB5E6E1000-memory.dmp
memory/5980-98-0x00007FFB5E7B0000-0x00007FFB5E849000-memory.dmp
memory/5980-96-0x00007FFB5E040000-0x00007FFB5E3E1000-memory.dmp