Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
28/09/2026, 20:11
General
- Target SyncRuntime98071.exe
- Size 89.7MB
- Sample260928-yyj2dsda49
- SHA256 017611d5d583630cb6cac78ce18e9906854b2797dfdc717d17053e97b9279ecb
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SyncRuntime98071.exe"C:\Users\Admin\AppData\Local\Temp\SyncRuntime98071.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WerFault.exe"C:\Windows\System32\WerFault.exe" -u -p 1124 -s 2407181402⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-5-0x0000024C00F10000-0x0000024C00F11000-memory.dmp
memory/1124-8-0x0000024C00F40000-0x0000024C00F41000-memory.dmp
memory/1124-19-0x0000024C00FF0000-0x0000024C00FF1000-memory.dmp
memory/1124-18-0x0000024C00FE0000-0x0000024C00FE1000-memory.dmp
memory/1124-17-0x0000024C00FD0000-0x0000024C00FD1000-memory.dmp
memory/1124-16-0x0000024C00FC0000-0x0000024C00FC1000-memory.dmp
memory/1124-15-0x0000024C00FB0000-0x0000024C00FB1000-memory.dmp
memory/1124-14-0x0000024C00FA0000-0x0000024C00FA1000-memory.dmp
memory/1124-13-0x0000024C00F90000-0x0000024C00F91000-memory.dmp
memory/1124-12-0x0000024C00F80000-0x0000024C00F81000-memory.dmp
memory/1124-11-0x0000024C00F70000-0x0000024C00F71000-memory.dmp
memory/1124-10-0x0000024C00F60000-0x0000024C00F61000-memory.dmp
memory/1124-9-0x0000024C00F50000-0x0000024C00F51000-memory.dmp
memory/1124-7-0x0000024C00F30000-0x0000024C00F31000-memory.dmp
memory/1124-6-0x0000024C00F20000-0x0000024C00F21000-memory.dmp
memory/1124-4-0x0000024C00F00000-0x0000024C00F01000-memory.dmp
memory/1124-20-0x0000024C01050000-0x0000024C01E05000-memory.dmp
memory/1124-24-0x0000024C02BD0000-0x0000024C0398A000-memory.dmp
memory/1124-21-0x0000024C01E10000-0x0000024C02BC6000-memory.dmp
memory/1124-34-0x0000024C02BD0000-0x0000024C0398A000-memory.dmp
memory/1124-33-0x0000024C02BD0000-0x0000024C0398A000-memory.dmp
memory/1124-36-0x0000024C02BD0000-0x0000024C0398A000-memory.dmp