fb096c07a4941f1cbad0bd470908cbff059265d631e6fc9e0e69bafc2b252783

Analysis

max time kernel
2s
max time network
15s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
سكآرس آلعنزي.exe
Size 19KB
Sample261014-xe59vazzet
SHA256 fb096c07a4941f1cbad0bd470908cbff059265d631e6fc9e0e69bafc2b252783
MD5 c441abd0268ca6b18aff0a926e42c507
SHA1 049890569102d4f98d5dbc6a856f8e33924b2577
SHA512 f3b02d0d787961cf01612973399af108d6278a74ca0c9a53b1909a9459048934619ad8d2c1db383530deb53fc114e7d2ce087c2c2de0830bbcc9772a502f17b4
SSDEEP 384:JutVbuQrKtCKrnIfn4gzvNbQstQI0QJc3qFJ9+f9Y4:JutVNOtprIgsFbbJd8+4
TLSH
T1B1924B48EBDC8278D69D0B3558F30B098531E5A6DE03DB8F1CD681692FB2BD997027D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit execution persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	mountvol.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
464	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	سكآرس آلعنزي.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	464	powercfg.exe
Token: SeCreatePagefilePrivilege	464	powercfg.exe
Token: SeShutdownPrivilege	464	powercfg.exe
Token: SeCreatePagefilePrivilege	464	powercfg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	سكآرس آلعنزي.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1304	سكآرس آلعنزي.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3952	1304	سكآرس آلعنزي.exe	89
PID 1304 wrote to memory of 464	1304	سكآرس آلعنزي.exe	91
PID 1304 wrote to memory of 2604	1304	سكآرس آلعنزي.exe	92
PID 1304 wrote to memory of 2080	1304	سكآرس آلعنزي.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\سكآرس آلعنزي.exe
"C:\Users\Admin\AppData\Local\Temp\سكآرس آلعنزي.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "سكآرس آلعنزي" /tr "C:\Users\Admin\AppData\Roaming\سكآرس آلعنزي.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3952
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /s
  2⤵
  PID:2604
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /d
  2⤵
  - Enumerates connected drives
  PID:2080