Analysis
- max time kernel
30s - max time network
37s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 17:38
Errors
General
- Target i wont lock your computer trust me im a cute girl uwu.exe
- Size 81.8MB
- Sample261012-v778ssec86
- SHA256 851d74287a07f49bc8457d4012d4bc4d5550f28d80f0831d78391cda35801f0d
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
- Drops file in Windows directory 1 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\i wont lock your computer trust me im a cute girl uwu.exe"C:\Users\Admin\AppData\Local\Temp\i wont lock your computer trust me im a cute girl uwu.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a24055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evbA07D.tmp
evbA0DC.tmp
evbA1D7.tmp
evbA245.tmp
evbA340.tmp
evbA351.tmp
memory/3264-54-0x0000000002AA0000-0x0000000003B91000-memory.dmp
memory/3264-61-0x0000000140000000-0x00000001400CD000-memory.dmp
memory/3264-0-0x0000000140000000-0x00000001400CD000-memory.dmp
memory/3264-7-0x0000000180000000-0x000000018123C000-memory.dmp
memory/3264-16-0x00000000006F0000-0x0000000000712000-memory.dmp
memory/3264-14-0x00000000006F0000-0x0000000000712000-memory.dmp
memory/3264-5-0x00007FF9BE9A0000-0x00007FF9BEC03000-memory.dmp
memory/3264-42-0x0000000003DF0000-0x0000000003F8B000-memory.dmp
memory/3264-39-0x0000000003DF0000-0x0000000003F8B000-memory.dmp
memory/3264-56-0x0000000002580000-0x0000000002625000-memory.dmp
memory/3264-55-0x0000000003DF0000-0x0000000003F8B000-memory.dmp
memory/3264-58-0x0000000180000000-0x000000018123C000-memory.dmp
memory/3264-12-0x00007FF9BE9A0000-0x00007FF9BEC03000-memory.dmp
memory/3264-60-0x0000000003BA0000-0x0000000003DE3000-memory.dmp
memory/3264-27-0x00007FF9BE9A0000-0x00007FF9BEC03000-memory.dmp
memory/3264-29-0x0000000003BA0000-0x0000000003DE3000-memory.dmp
memory/3264-50-0x0000000002580000-0x0000000002625000-memory.dmp
memory/3264-47-0x0000000002580000-0x0000000002625000-memory.dmp
memory/3264-3-0x00007FF9BEAFF000-0x00007FF9BEB00000-memory.dmp
memory/3264-34-0x0000000003BA0000-0x0000000003DE3000-memory.dmp
memory/3264-23-0x0000000002AA0000-0x0000000003B91000-memory.dmp
memory/3264-20-0x0000000002AA0000-0x0000000003B91000-memory.dmp
memory/3264-53-0x00007FF9BE9A0000-0x00007FF9BEC03000-memory.dmp
memory/3264-59-0x00000000006F0000-0x0000000000712000-memory.dmp
memory/3264-66-0x0000000003DF0000-0x0000000003F8B000-memory.dmp
memory/3264-62-0x0000000180000000-0x000000018123C000-memory.dmp
memory/3264-64-0x0000000002AA0000-0x0000000003B91000-memory.dmp
memory/3264-68-0x00007FF9BE9A0000-0x00007FF9BEC03000-memory.dmp