Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/09/2026, 14:01
General
- Target file.exe
- Size 29.2MB
- Sample260920-rb18tsak2s
- SHA256 c7d3e623a2fe45f8a20ab5de3da52ea446e27265054a47624df78fdd4ddbd670
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Creates a file in the Startup directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-2-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-3-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-4-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-5-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-6-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-7-0x0000000244E40000-0x0000000248664000-memory.dmp
memory/872-28-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-30-0x0000000244E40000-0x0000000248664000-memory.dmp
memory/872-29-0x0000000244E40000-0x0000000248664000-memory.dmp
memory/872-27-0x0000000244E40000-0x0000000248664000-memory.dmp
memory/872-32-0x0000000244E40000-0x0000000248664000-memory.dmp
memory/872-31-0x0000000244E40000-0x0000000248664000-memory.dmp
memory/872-33-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-34-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-35-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-36-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-37-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-38-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-39-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp
memory/872-40-0x00007FF696DB0000-0x00007FF69AB43000-memory.dmp