6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd

Analysis

user interaction
yes
max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.exe
Size 14KB
Sample261014-prs62sc16w
SHA256 6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd
MD5 6ccfab5f4d27f02d8c79cd7442519290
SHA1 f22864cad119a3e074e8a3f1619e46a63a91abf7
SHA512 4377257e45d8ceb2b82b39958c2c8e97048acdf2df3f0c39280e506c490cdd3cc631d1f791ae98f798656ed5c8535e0a152cb4c336520ab0ed7badd9d846e853
SSDEEP 384:/2KNueTrZumZOLoTer9ZSZwnZFJp0Bgr9Y4:ubWdIr9TuL4
TLSH
T1A2620804EBE88794EABD0F3969F313554231E4E3D903CB8D18E4025B7E71BD59600BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2476	3.exe
2684	3.exe
2752	3.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	mountvol.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3292	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2088	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	powercfg.exe
Token: SeCreatePagefilePrivilege	3292	powercfg.exe
Token: SeShutdownPrivilege	3292	powercfg.exe
Token: SeCreatePagefilePrivilege	3292	powercfg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3660	3.exe
3660	3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2088	3660	3.exe	89
PID 3660 wrote to memory of 3292	3660	3.exe	91
PID 3660 wrote to memory of 4440	3660	3.exe	92
PID 3660 wrote to memory of 4520	3660	3.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "3" /tr "C:\Users\Admin\AppData\Roaming\3.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2088
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /s
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /d
  2⤵
  - Enumerates connected drives
  PID:4520

C:\Users\Admin\AppData\Roaming\3.exe
C:\Users\Admin\AppData\Roaming\3.exe
1⤵
- Executes dropped EXE
PID:2476

C:\Users\Admin\AppData\Roaming\3.exe
"C:\Users\Admin\AppData\Roaming\3.exe"
1⤵
- Executes dropped EXE
PID:2684

C:\Users\Admin\AppData\Roaming\3.exe
"C:\Users\Admin\AppData\Roaming\3.exe"
1⤵
- Executes dropped EXE
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3.exe

Path C:\Users\Admin\AppData\Roaming\3.exe
Size 14KB
SHA256 6c099effcacee3c0572925a6084b39efc56e5d37110a0301d7775742bfc13dcd
MD5 6ccfab5f4d27f02d8c79cd7442519290
SHA1 f22864cad119a3e074e8a3f1619e46a63a91abf7
SHA512 4377257e45d8ceb2b82b39958c2c8e97048acdf2df3f0c39280e506c490cdd3cc631d1f791ae98f798656ed5c8535e0a152cb4c336520ab0ed7badd9d846e853
SSDEEP 384:/2KNueTrZumZOLoTer9ZSZwnZFJp0Bgr9Y4:ubWdIr9TuL4
TLSH
T1A2620804EBE88794EABD0F3969F313554231E4E3D903CB8D18E4025B7E71BD59600BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3660-0-0x00007FF8C59AF000-0x00007FF8C59B0000-memory.dmp

Download

memory/3660-1-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Download

memory/3660-2-0x00007FF8C5820000-0x00007FF8C61C4000-memory.dmp

Download

memory/3660-3-0x00007FF8C5820000-0x00007FF8C61C4000-memory.dmp

Download

memory/3660-4-0x00007FF8C5820000-0x00007FF8C61C4000-memory.dmp

Download

memory/3660-5-0x00007FF8C5820000-0x00007FF8C61C4000-memory.dmp

Download

memory/3660-7-0x00007FF8C5820000-0x00007FF8C61C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads