Analysis
- user interaction
yes - max time kernel
134s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 22:19
General
- Target tw2nmnv.exe
- Size 8.8MB
- Sample261011-18tppaaa63
- SHA256 ddb0c5db9e763dec32134e252da8bfe308ac6603b98761c052c6a4dbeca0a87f
Malware Config
Signatures
- Loads dropped DLL 12 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tw2nmnv.exe"C:\Users\Admin\AppData\Local\Temp\tw2nmnv.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tw2nmnv.exe"C:\Users\Admin\AppData\Local\Temp\tw2nmnv.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
memory/4736-184-0x000000001D570000-0x000000001E3ED000-memory.dmp
memory/5696-47-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-56-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-45-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-48-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-49-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-50-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-51-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-52-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-53-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-54-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-55-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-46-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-59-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/5696-43-0x00000175A4FA0000-0x00000175A4FA1000-memory.dmp
memory/5696-44-0x00000175A5110000-0x00000175A5804000-memory.dmp
memory/8548-62-0x000001D1801E0000-0x000001D1802E0000-memory.dmp
memory/8548-79-0x000001D193E50000-0x000001D193F50000-memory.dmp
memory/8548-77-0x000001D183C50000-0x000001D183C70000-memory.dmp
memory/8548-111-0x000001D194270000-0x000001D194290000-memory.dmp
memory/8548-92-0x000001D183DD0000-0x000001D183DF0000-memory.dmp
memory/8548-63-0x000001D1801E0000-0x000001D1802E0000-memory.dmp