Analysis
- user interaction
yes - max time kernel
149s - max time network
176s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 17:20
General
- Target Evidence_of_Violation.zip
- Size 359.6MB
- Sample260916-vwpbjstble
- SHA256 fa5353207aad956bf2ace2d515643327f7dc75aa7726a50667dbbdaeeec1b7cf
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Evidence_of_Violation.zip1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\47ad7d81-80e5-4671-94b4-7c452ce9de7a_Evidence_of_Violation.zip.e7a\Evidence_of_Violation.docx.exe"C:\Users\Admin\AppData\Local\Temp\47ad7d81-80e5-4671-94b4-7c452ce9de7a_Evidence_of_Violation.zip.e7a\Evidence_of_Violation.docx.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Evidence_of_Violation\Evidence_of_Violation.docx.exe"C:\Users\Admin\Desktop\Evidence_of_Violation\Evidence_of_Violation.docx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5216 -ip 52161⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4196-183-0x00000000084D0000-0x0000000008B4C000-memory.dmp
memory/4196-182-0x0000000007890000-0x0000000007E4A000-memory.dmp
memory/4196-171-0x0000000005460000-0x0000000005482000-memory.dmp
memory/4196-172-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/4196-173-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/4196-176-0x0000000005D50000-0x00000000060AB000-memory.dmp
memory/4196-170-0x00000000054B0000-0x0000000005AFA000-memory.dmp
memory/4196-179-0x0000000007230000-0x00000000072C6000-memory.dmp
memory/4196-169-0x00000000029F0000-0x0000000002A26000-memory.dmp
memory/4196-180-0x0000000006760000-0x000000000677A000-memory.dmp
memory/4196-181-0x00000000067B0000-0x00000000067D2000-memory.dmp
memory/4196-178-0x00000000062E0000-0x000000000632C000-memory.dmp
memory/4196-177-0x0000000006210000-0x000000000622E000-memory.dmp
memory/5216-214-0x0000000078AA0000-0x0000000078B5F000-memory.dmp
memory/5216-168-0x0000000078AA0000-0x0000000078B5F000-memory.dmp
memory/5896-27-0x00007FF88C870000-0x00007FF88C889000-memory.dmp
memory/5896-48-0x00007FF876A10000-0x00007FF876A35000-memory.dmp
memory/5896-14-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-15-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-17-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-20-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-21-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-22-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-19-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-18-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-16-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-12-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-13-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-24-0x00007FF884AB0000-0x00007FF884AE4000-memory.dmp
memory/5896-23-0x00007FF6AE100000-0x00007FF6AE1F8000-memory.dmp
memory/5896-29-0x00007FF87A510000-0x00007FF87A53B000-memory.dmp
memory/5896-28-0x00007FF87E150000-0x00007FF87E172000-memory.dmp
memory/5896-10-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-30-0x00007FF877210000-0x00007FF8775A0000-memory.dmp
memory/5896-34-0x00007FF876F70000-0x00007FF877206000-memory.dmp
memory/5896-35-0x00007FF876E80000-0x00007FF876F68000-memory.dmp
memory/5896-50-0x00007FF876940000-0x00007FF87695B000-memory.dmp
memory/5896-46-0x00007FF876A90000-0x00007FF876B28000-memory.dmp
memory/5896-49-0x00007FF876960000-0x00007FF876A0B000-memory.dmp
memory/5896-45-0x00007FF876B30000-0x00007FF876D3B000-memory.dmp
memory/5896-8-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-51-0x00007FF86CD10000-0x00007FF86CF55000-memory.dmp
memory/5896-47-0x00007FF876A40000-0x00007FF876A8F000-memory.dmp
memory/5896-36-0x00007FF876D90000-0x00007FF876E73000-memory.dmp
memory/5896-44-0x00007FF87A5A0000-0x00007FF87A5B1000-memory.dmp
memory/5896-43-0x00007FF87E130000-0x00007FF87E141000-memory.dmp
memory/5896-42-0x00007FF8821D0000-0x00007FF8821EA000-memory.dmp
memory/5896-41-0x00007FF877990000-0x00007FF8779BD000-memory.dmp
memory/5896-40-0x00007FF877A60000-0x00007FF877A86000-memory.dmp
memory/5896-39-0x00007FF8865B0000-0x00007FF8865C8000-memory.dmp
memory/5896-38-0x00007FF8790C0000-0x00007FF8790EF000-memory.dmp
memory/5896-11-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-9-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-7-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-6-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-5-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-3-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-4-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-2-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-1-0x00007FF877B70000-0x00007FF877E26000-memory.dmp
memory/5896-0-0x00007FF877E1D000-0x00007FF877E1F000-memory.dmp
memory/5896-37-0x00007FF876D40000-0x00007FF876D81000-memory.dmp
memory/5896-33-0x00007FF877A90000-0x00007FF877B62000-memory.dmp
memory/5896-32-0x00007FF88B7B0000-0x00007FF88B7C1000-memory.dmp
memory/5896-31-0x00007FF88BDD0000-0x00007FF88BDE4000-memory.dmp
memory/5896-26-0x00007FF88E230000-0x00007FF88E241000-memory.dmp