Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 08:56
General
- Target WindowTabs.exe
- Size 9.4MB
- Sample261003-kv3gnswt3m
- SHA256 821438bfa26d91b0dc739088bf0b9ef7ea83646c52ae2545ee0644a9441ee6ca
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowTabs.exe"C:\Users\Admin\AppData\Local\Temp\WindowTabs.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
WindowTabsSettings.txt
WindowTabsSettings.txt.tmp
WindowTabsSettings.txt.tmp
memory/5016-25-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-27-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-5-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-3-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-20-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-2-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-9-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-21-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-22-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-23-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-24-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-0-0x00007FFD1623F000-0x00007FFD16240000-memory.dmp
memory/5016-26-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-4-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-28-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-29-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-1-0x0000000000CD0000-0x000000000163A000-memory.dmp
memory/5016-38-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-39-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-40-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-41-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-42-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-43-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-44-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp
memory/5016-45-0x00007FFD160B0000-0x00007FFD16A54000-memory.dmp