b9bdd5e535db93c9d6fd0b29b91383ac6c1c40304519796894f7958265ad3c57

Analysis

max time kernel
1s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
q.exe
Size 16KB
Sample261014-prs62sc16w
SHA256 b9bdd5e535db93c9d6fd0b29b91383ac6c1c40304519796894f7958265ad3c57
MD5 af3cdc7cd49c4091f72464d65a83953d
SHA1 a7531b80fefb9c9c8ea9209147c867495a9ba2ff
SHA512 00a5fd43092811edb7452d8416a293b316eb0ff0a22e42c2c92684574be29f848829ec46dcd97fdaa7387d0fa16979fb615e2b78d008a094738cea51113b171c
SSDEEP 384:jsWdC0Gu+ALtmlItV5IAgeMy9kSZwudFJQfBgr9Y4:gWdCpytz3Tr9XkL4
TLSH
T1B2722A44EBF98314D77E0B7A29F313154A31F9969E03CB8F28EC42667E71AD49640BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit execution persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	mountvol.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1168	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	q.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1396	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1168	powercfg.exe
Token: SeCreatePagefilePrivilege	1168	powercfg.exe
Token: SeShutdownPrivilege	1168	powercfg.exe
Token: SeCreatePagefilePrivilege	1168	powercfg.exe
Token: SeShutdownPrivilege	4128	q.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4128	q.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4128	q.exe
4128	q.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1396	4128	q.exe	87
PID 4128 wrote to memory of 1168	4128	q.exe	89
PID 4128 wrote to memory of 2228	4128	q.exe	90
PID 4128 wrote to memory of 2564	4128	q.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\q.exe
"C:\Users\Admin\AppData\Local\Temp\q.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "q" /tr "C:\Users\Admin\AppData\Roaming\q.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1396
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /s
  2⤵
  PID:2228
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /d
  2⤵
  - Enumerates connected drives
  PID:2564