Overview
overview
7Static
static
3Endermanch...08.exe
windows10-2004-x64
7Endermanch...08.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...lf.dll
windows10-2004-x64
7$PLUGINSDI...lf.dll
windows11-ltsc_2024-x64
5$PLUGINSDI...ey.dll
windows10-2004-x64
3$PLUGINSDI...ey.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/Mutex.dll
windows10-2004-x64
3$PLUGINSDIR/Mutex.dll
windows11-ltsc_2024-x64
3$TEMP/pin.vbs
windows10-2004-x64
5$TEMP/pin.vbs
windows11-ltsc_2024-x64
5$_7_.exe
windows10-2004-x64
7$_7_.exe
windows11-ltsc_2024-x64
7MFC71.dll
windows10-2004-x64
3MFC71.dll
windows11-ltsc_2024-x64
3MFC71ENU.dll
windows10-2004-x64
1MFC71ENU.dll
windows11-ltsc_2024-x64
1Uninstall.exe
windows10-2004-x64
7Uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ey.dll
windows10-2004-x64
3$PLUGINSDI...ey.dll
windows11-ltsc_2024-x64
3msvcp71.dll
windows10-2004-x64
3msvcp71.dll
windows11-ltsc_2024-x64
3msvcr71.dll
windows10-2004-x64
3msvcr71.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 11:09
windows10-2004-x64
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillSelf.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillSelf.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/MachineKey.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/MachineKey.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Mutex.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Mutex.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$TEMP/pin.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$TEMP/pin.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
$_7_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$_7_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
MFC71.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
MFC71.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
MFC71ENU.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
MFC71ENU.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Uninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Uninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/MachineKey.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/MachineKey.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
msvcp71.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
msvcp71.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
msvcr71.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
msvcr71.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target $_7_.exe
- Size 9.0MB
- Sample260930-m9b95ssdlf
- SHA256 d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9
- MD5 04b88c7067b53a9bdf844cd1cb4b9c30
- SHA1 7d081a1053cd9ef3d593f5ef9a27303824b779f5
- SHA512 566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42
- SSDEEP 98304:/Otj27sBeLQztuYrwCiHyvD04zARp4hm5dQrm1:/OFwCVi
- TLSH T17C96619165E89191D1230638FE4DD8AD21C8FCCA5F4156EF71823B5B7E3B7C03A89A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3928 pphcjb0j0ev63.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\pphcjb0j0ev63.exe $_7_.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname $_7_.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $_7_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pphcjb0j0ev63.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5400 $_7_.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5400 $_7_.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe - Suspicious use of SendNotifyMessage 26 IoCs
pid Process 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe - Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe 5400 $_7_.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5400 wrote to memory of 3928 5400 $_7_.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_7_.exe"C:\Users\Admin\AppData\Local\Temp\$_7_.exe"1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\pphcjb0j0ev63.exe"C:\Windows\system32\pphcjb0j0ev63.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3928
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\pphcjb0j0ev63.exe
- Size 92KB
- SHA256 f6963bc0c9343d33102628766539d849939188c7fb05db82e9a9f49920a98330
- MD5 c90738662f7ea8dfcdf2ad26617171f9
- SHA1 9a3f3b0458d0e12d0789a73fd0c6151d0e158cf4
- SHA512 e645b1113e4683fc88b7a442b5dd87c846810d639d07b87fa32bddf96fee70645b051154594560a36a8460d6ff7b00bc0f64f7b0bf3ef8c6c46ca544fd21aa4a
- SSDEEP 1536:zgBytR9M994bVs3r+O56dsA1n6nbw2/GyKkqACZ2OlwXy9:So9M994e36a+nBklqACZ2OlwX
- TLSH T186937D23B1D18675E81702766CAD8B59AB36B9014B608EC3FF6C1E5F9F322D4493A3C5
- MD5 SHA1 SHA512 SSDEEP TLSH