Analysis
- user interaction
yes - max time kernel
151s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 20:43
General
- Target eyes_screen.exe
- Size 33.0MB
- Sample260930-zhwwpas1ay
- SHA256 8734c2288dc437d53679cbe65dc051a31a607ddfd8b17d7391efde7d4802014d
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Disables Task Manager via registry modification
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Loads dropped DLL 25 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Windows directory 2 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eyes_screen.exe"C:\Users\Admin\AppData\Local\Temp\eyes_screen.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eyes_screen.exe"C:\Users\Admin\AppData\Local\Temp\eyes_screen.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Disable-WindowsOptionalFeature -Online -FeatureName WindowsSandbox""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Disable-WindowsOptionalFeature -Online -FeatureName WindowsSandbox"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {269539D3-ECD3-4B9D-A9F2-0DFB04675FB4}5⤵
- Drops file in Windows directory
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp311-win_amd64.pyd
_imagingft.cp311-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
icons.tcl
pkgIndex.tcl
tk.tcl
_tkinter.pyd
base_library.zip
_rust.pyd
libcrypto-3-x64.dll
libffi-8.dll
libssl-3-x64.dll
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
unicodedata.pyd
__PSScriptPolicyTest_hs0a3xa3.eao.ps1
dism.log
memory/1264-1076-0x000001DD4A5F0000-0x000001DD4A612000-memory.dmp
memory/1264-1080-0x000001DD62990000-0x000001DD62A42000-memory.dmp
memory/1264-1079-0x000001DD62800000-0x000001DD6281E000-memory.dmp
memory/1264-1081-0x000001DD62820000-0x000001DD6282A000-memory.dmp
memory/3620-1088-0x0000015D6FB00000-0x0000015D6FB28000-memory.dmp
memory/5952-1126-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1129-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1130-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1132-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1133-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1134-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1135-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1136-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1137-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1138-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1139-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1140-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1141-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp
memory/5952-1142-0x0000020ED81A0000-0x0000020ED8783000-memory.dmp