Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
15/10/2026, 17:17
General
- Target IMG_958742253158.scr.exe
- Size 428KB
- Sample261015-vtthgsty2m
- SHA256 9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Drops file in System32 directory 11 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 30 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_958742253158.scr.exe"C:\Users\Admin\AppData\Local\Temp\IMG_958742253158.scr.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe "C:\Users\Admin\AppData\Local\IMG_958742253158.png"2⤵
-
-
C:\Users\Admin\AppData\Local\Wavesoft\4ee68d21-9aa9-47e0-81c2-3a6d2b916ada\winsec.exe"C:\Users\Admin\AppData\Local\Wavesoft\4ee68d21-9aa9-47e0-81c2-3a6d2b916ada\winsec.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "dir C:"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "net config workstation"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet config workstation4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\IMG_958742253158.png" /ForceBootstrapPaint3D2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
IMG_958742253158.png
selectors.cpython-39.pyc
socket.cpython-39.pyc
subprocess.cpython-39.pyc
threading.cpython-39.pyc
INSTALLER
_webp.pyi
__init__.py
__init__.cpython-39.pyc
dnssec.cpython-39.pyc
edns.cpython-39.pyc
entropy.cpython-39.pyc
exception.cpython-39.pyc
flags.cpython-39.pyc
inet.cpython-39.pyc
ipv4.cpython-39.pyc
ipv6.cpython-39.pyc
message.cpython-39.pyc
name.cpython-39.pyc
node.cpython-39.pyc
opcode.cpython-39.pyc
query.cpython-39.pyc
rcode.cpython-39.pyc
rdata.cpython-39.pyc
rdataclass.cpython-39.pyc
rdataset.cpython-39.pyc
rdatatype.cpython-39.pyc
renderer.cpython-39.pyc
resolver.cpython-39.pyc
reversename.cpython-39.pyc
rrset.cpython-39.pyc
set.cpython-39.pyc
tokenizer.cpython-39.pyc
tsig.cpython-39.pyc
ttl.cpython-39.pyc
wiredata.cpython-39.pyc
SOA.cpython-39.pyc
__init__.cpython-39.pyc
__init__.cpython-39.pyc
__init__.cpython-39.pyc
dnskeybase.cpython-39.pyc
dsbase.cpython-39.pyc
euibase.cpython-39.pyc
mxbase.cpython-39.pyc
nsbase.cpython-39.pyc
txtbase.cpython-39.pyc
tornado.cpython-39.pyc
WHEEL
__init__.py
__init__.py
LICENSE.APACHE2
WHEEL
__init__.py
__future__.py
_bootlocale.py
_collections_abc.py
_sitebuiltins.py
_weakrefset.py
abc.py
codecs.py
__init__.py
abc.py
contextlib.py
copyreg.py
__init__.py
aliases.py
cp1252.py
latin_1.py
utf_8.py
enum.py
functools.py
genericpath.py
heapq.py
__init__.py
client.py
__init__.py
abc.py
machinery.py
util.py
io.py
keyword.py
linecache.py
__init__.py
ntpath.py
operator.py
os.py
re.py
reprlib.py
oberon.py
pywin32.pth
__init__.py
sitecustomize.py
__init__.py
exceptions.py
six.py
pywin32_bootstrap.py
site.py
sre_compile.py
sre_constants.py
sre_parse.py
stat.py
string.py
struct.py
threading.py
token.py
tokenize.py
traceback.py
types.py
typing.py
warnings.py
weakref.py
python39.dll
vcruntime140.dll
winsec.exe
DSS.log
memory/3000-19-0x000002B0736E0000-0x000002B0736E1000-memory.dmp
memory/3000-21-0x000002B0736F0000-0x000002B0736F1000-memory.dmp
memory/3000-20-0x000002B0736E0000-0x000002B0736E1000-memory.dmp
memory/3000-18-0x000002B073650000-0x000002B073651000-memory.dmp
memory/3000-16-0x000002B073650000-0x000002B073651000-memory.dmp
memory/3000-14-0x000002B0735D0000-0x000002B0735D1000-memory.dmp
memory/3000-24-0x000002B0736F0000-0x000002B0736F1000-memory.dmp
memory/3000-3-0x000002B062950000-0x000002B062960000-memory.dmp
memory/3000-6-0x000002B062980000-0x000002B062990000-memory.dmp