Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 17:17
General
- Target IMG_958742253158.scr.exe
- Size 428KB
- Sample261015-vtthgsty2m
- SHA256 9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 33 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_958742253158.scr.exe"C:\Users\Admin\AppData\Local\Temp\IMG_958742253158.scr.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe "C:\Users\Admin\AppData\Local\IMG_958742253158.png"2⤵
-
-
C:\Users\Admin\AppData\Local\Wavesoft\c5619665-1f1d-4b62-a34a-629d248ae5f0\winsec.exe"C:\Users\Admin\AppData\Local\Wavesoft\c5619665-1f1d-4b62-a34a-629d248ae5f0\winsec.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "dir C:"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "net config workstation"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet config workstation4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\IMG_958742253158.png"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
IMG_958742253158.png
selectors.cpython-39.pyc
socket.cpython-39.pyc
subprocess.cpython-39.pyc
threading.cpython-39.pyc
INSTALLER
_webp.pyi
__init__.py
__init__.cpython-39.pyc
dnssec.cpython-39.pyc
edns.cpython-39.pyc
entropy.cpython-39.pyc
exception.cpython-39.pyc
flags.cpython-39.pyc
inet.cpython-39.pyc
ipv4.cpython-39.pyc
ipv6.cpython-39.pyc
message.cpython-39.pyc
name.cpython-39.pyc
node.cpython-39.pyc
opcode.cpython-39.pyc
query.cpython-39.pyc
rcode.cpython-39.pyc
rdata.cpython-39.pyc
rdataclass.cpython-39.pyc
rdataset.cpython-39.pyc
rdatatype.cpython-39.pyc
renderer.cpython-39.pyc
resolver.cpython-39.pyc
reversename.cpython-39.pyc
rrset.cpython-39.pyc
set.cpython-39.pyc
tokenizer.cpython-39.pyc
tsig.cpython-39.pyc
ttl.cpython-39.pyc
wiredata.cpython-39.pyc
SOA.cpython-39.pyc
__init__.cpython-39.pyc
__init__.cpython-39.pyc
__init__.cpython-39.pyc
dnskeybase.cpython-39.pyc
dsbase.cpython-39.pyc
euibase.cpython-39.pyc
mxbase.cpython-39.pyc
nsbase.cpython-39.pyc
txtbase.cpython-39.pyc
tornado.cpython-39.pyc
WHEEL
__init__.py
__init__.py
LICENSE.APACHE2
WHEEL
__init__.py
VCRUNTIME140.dll
__future__.py
_bootlocale.py
_collections_abc.py
_sitebuiltins.py
_weakrefset.py
abc.py
codecs.py
__init__.py
abc.py
contextlib.py
copyreg.py
__init__.py
aliases.py
cp1252.py
latin_1.py
utf_8.py
enum.py
functools.py
genericpath.py
heapq.py
__init__.py
client.py
__init__.py
abc.py
machinery.py
util.py
io.py
keyword.py
linecache.py
__init__.py
ntpath.py
operator.py
os.py
re.py
reprlib.py
oberon.py
pywin32.pth
__init__.py
sitecustomize.py
__init__.py
exceptions.py
six.py
pywin32_bootstrap.py
site.py
sre_compile.py
sre_constants.py
sre_parse.py
stat.py
string.py
struct.py
threading.py
token.py
tokenize.py
traceback.py
types.py
typing.py
warnings.py
weakref.py
python39.dll
winsec.exe