Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 12:34
General
- Target 2fe01afce149ba12041135491c46d98e6bde5d3af5ffee810695aa0d579e925d.exe
- Size 60KB
- Sample261002-prrm8asbng
- SHA256 2fe01afce149ba12041135491c46d98e6bde5d3af5ffee810695aa0d579e925d
Malware Config
Signatures
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fe01afce149ba12041135491c46d98e6bde5d3af5ffee810695aa0d579e925d.exe"C:\Users\Admin\AppData\Local\Temp\2fe01afce149ba12041135491c46d98e6bde5d3af5ffee810695aa0d579e925d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg.exe" /aliases2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg.exe" /qh 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4904-0-0x00007FFE79ABF000-0x00007FFE79AC0000-memory.dmp
memory/4904-1-0x0000000000690000-0x00000000006A4000-memory.dmp
memory/4904-2-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-3-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-4-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-5-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-6-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-7-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-8-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-9-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-10-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-11-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-12-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-13-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-14-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-15-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/4904-16-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp