6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.exe
Size 14KB
Sample261014-prs62sc16w
SHA256 6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd
MD5 6ccfab5f4d27f02d8c79cd7442519290
SHA1 f22864cad119a3e074e8a3f1619e46a63a91abf7
SHA512 4377257e45d8ceb2b82b39958c2c8e97048acdf2df3f0c39280e506c490cdd3cc631d1f791ae98f798656ed5c8535e0a152cb4c336520ab0ed7badd9d846e853
SSDEEP 384:/2KNueTrZumZOLoTer9ZSZwnZFJp0Bgr9Y4:ubWdIr9TuL4
TLSH
T1A2620804EBE88794EABD0F3969F313554231E4E3D903CB8D18E4025B7E71BD59600BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4204	3.exe
3064	3.exe
3216	3.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	mountvol.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4692	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4276	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4692	powercfg.exe
Token: SeCreatePagefilePrivilege	4692	powercfg.exe
Token: SeShutdownPrivilege	4692	powercfg.exe
Token: SeCreatePagefilePrivilege	4692	powercfg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4728	3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4728	3.exe
4728	3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4276	4728	3.exe	86
PID 4728 wrote to memory of 4692	4728	3.exe	88
PID 4728 wrote to memory of 2636	4728	3.exe	89
PID 4728 wrote to memory of 1212	4728	3.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "3" /tr "C:\Users\Admin\AppData\Roaming\3.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4276
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /s
  2⤵
  PID:2636
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /d
  2⤵
  - Enumerates connected drives
  PID:1212

C:\Users\Admin\AppData\Roaming\3.exe
C:\Users\Admin\AppData\Roaming\3.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Users\Admin\AppData\Roaming\3.exe
C:\Users\Admin\AppData\Roaming\3.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Roaming\3.exe
C:\Users\Admin\AppData\Roaming\3.exe
1⤵
- Executes dropped EXE
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3.exe.log
Size 42B
SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
MD5 84cfdb4b995b1dbf543b26b86c863adc
SHA1 d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA512 485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
MD5 SHA1 SHA512

Submit Download

3.exe

Path C:\Users\Admin\AppData\Roaming\3.exe
Size 14KB
SHA256 6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd
MD5 6ccfab5f4d27f02d8c79cd7442519290
SHA1 f22864cad119a3e074e8a3f1619e46a63a91abf7
SHA512 4377257e45d8ceb2b82b39958c2c8e97048acdf2df3f0c39280e506c490cdd3cc631d1f791ae98f798656ed5c8535e0a152cb4c336520ab0ed7badd9d846e853
SSDEEP 384:/2KNueTrZumZOLoTer9ZSZwnZFJp0Bgr9Y4:ubWdIr9TuL4
TLSH
T1A2620804EBE88794EABD0F3969F313554231E4E3D903CB8D18E4025B7E71BD59600BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4728-0-0x0000000000050000-0x000000000005A000-memory.dmp

Download

memory/4728-2-0x0000000002150000-0x0000000002160000-memory.dmp

Download

memory/4728-6-0x0000000002150000-0x0000000002160000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads