Analysis
- max time kernel
1s - max time network
10s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 18:29
Errors
General
- Target HitDevice.exe
- Size 19KB
- Sample261014-w4621ahd59
- SHA256 10f9775f18e2a3969c1cc174cf2e0ae708b704f0c8c45279910ad1416e7c9630
Malware Config
Signatures
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\HitDevice.exe"C:\Users\Admin\AppData\Local\Temp\HitDevice.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /sc minute /mo 1 /tn "HitDevice" /tr "C:\Users\Admin\AppData\Roaming\HitDevice.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" /h off2⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Z: /s2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Z: /d2⤵
-
-
C:\Users\Admin\AppData\Roaming\HitDevice.exeC:\Users\Admin\AppData\Roaming\HitDevice.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004B01⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HitDevice.exe
memory/2748-6-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-2-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-3-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-4-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-5-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-0-0x00007FFD5E84F000-0x00007FFD5E850000-memory.dmp
memory/2748-7-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-1-0x0000000000830000-0x000000000083C000-memory.dmp
memory/2748-9-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-10-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-11-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp
memory/2748-12-0x00007FFD5E6C0000-0x00007FFD5F064000-memory.dmp